Bringing Calm 

to Chaos 

A critical incident review of the San Bernardino public safety response to the 

December 2, 2015, terrorist shooting incident at the Inland Regional Center 

Rick Braziel, Frank Straub, George Watson, and Rod Hoops 

Bringing Calm 

to Chaos 

A critical incident review of the San Bernardino public safety response to the
 

December 2, 2015, terrorist shooting incident at the Inland Regional Center
 

Rick Braziel, Frank Straub, George Watson, and Rod Hoops 
 

 

 

 

 

 

 

 

 

 

 

This project was supported by grant number 2015-CK-WX-K005 awarded by the Office of Community Oriented Policing Services, U.S.
 

Department of Justice. The opinions contained herein are those of the author(s) and do not necessarily represent the official position or policies
 

of the U.S. Department of Justice. References to specific agencies, companies, products, or services should not be considered an endorsement
 

by the author(s) or the U.S. Department of Justice. Rather, the references are illustrations to supplement discussion of the issues.
 

The Internet references cited in this publication were valid as of the date of publication. Given that URLs and websites are in constant flux,
 

neither the author(s) nor the COPS Office can vouch for their current validity.
 

Recommended citation:
 

Braziel, Rick, Frank Straub, George Watson, and Rod Hoops. 2016. Bringing Calm to Chaos: A Critical Incident Review of the San Bernardino
 

Public Safety Response to the December 2, 2015, Terrorist Shooting Incident at the Inland Regional Center. Critical Response Initiative. Washington, DC: Office of Community Oriented Policing Services.
 

Published 2016
 
 

 

 

 

 

 

 

 

 

 

 

 

 

 

Contents
 

Letter from the Director of the COPS Office .....................................................................................vii
 

Letter from the President of the Police Foundation ...........................................................................

...........................................................................................................................

.........................................................................................................................

............................................................................................................................................

.............................................................................................................................................

......................................................................................................................................

......................................................................... 

........................................................................................................................ 

...................................................................................................

..................................................................................................................................

.................................................................................................................................

.......................................................................................................................................... 

ix
 

Acknowledgements xi
 

Executive Summary xiii
 

Introduction xiii
 

Conclusion xvii
 

Introduction 1
 

The COPS Office Critical Response Technical Assistance 1
 

Scope and goals of review 2
 

National and international implications 4
 

Report organization 4
 

1. Methodology 5
 

Data collection 5
 

Analysis ...................................................................................................................................................

............................................................................................................

.............................................................................

..............................................................................................................................................

............................................

10
 

Development of lessons learned 10
 

2. Incident Context and Background Information 11
 

Geography 11
 

A history of collaboration: Responding public safety agency descriptions 16
 

iii 
 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

3. Police Response to Terrorist Shooting at Inland Regional Center....................................................

..........................................................................................................

................................................................................................................................

........................................................................................................................................

...................................................................................................

................................................................................................................

.......................................................................................................................

...............................................................................................................................

...............................................................................................................

..................................................................................

..............................................................................................................

25
 

A normal start to a traumatic day 25
 

The first to respond 27
 

Pandemonium 30
 

Agency leaders arrive and take charge 31
 

An army of probation officers 32
 

Training for the real thing 32
 

Clearing the building 33
 

Getting victims safely to triage 34
 

Triage and transport: The golden hour rings true 36
 

Discovery of secondary devices 36
 

A lead surfaces........................................................................................................................................

............................................................................................................................................

..................................................................................................................

...........................................................................................................................

........................................................................................

.......................................................................................................

.........................................................................................

....................................................................................................................................

.........................................................................................................................................

..................................................................................................................................................

37
 

The gunfight 38
 

Keeping the public informed 40
 

Hundreds of witnesses 42
 

Multiple scenes tackled by multiple agencies 44
 

The officer-involved shooting scene 44
 

The coroner: Investigation and notifications 46
 

The media frenzy 47
 

The aftermath 48
 

Timeline 49
 

iv Bringing Calm to Chaos: The San Bernardino Public Safety Response 
 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

4. Leadership ...................................................................................................................................

........................................................................................................................................................

.......................................................................................

......................................................................................................................

...............................................................................................................................................

......................................................................................................................

....................................................................................................................

.................................................................................................................

................................................................................................

.....................................................................................................................................

..................................................................................................

51
 

Trust 51
 

Previous critical incident debriefs and reports 52
 

Organizational awareness 53
 

Teamwork 54
 

Managing elected officials 54
 

Leadership lessons learned 55
 

5. Command and Control 59
 

Incident command and command posts 60
 

Self-deployment 60
 

Command and control lessons learned 62
 

6. Planning and Response.................................................................................................................

...................................................................................................................................................

.....................................................................................................................................

.......................................................................................................................................

............................................................................................................................................

.............................................................................................

...............................................................................................................................

.................................................................................................................................

.....................................................................................................................................

............................................................................................................................

................................................................................................................ 

67
 

Training 67
 

Communications 71
 

Building search 72
 

Trauma care 72
 

Planning and preparation lessons learned 76
 

7. Investigations 85
 

Promising practices 85
 

Parallel interests 86
 

Victims and witnesses 87
 

Investigations lessons learned 88
 

Contents v 
 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

8. Community Engagement, Relationships, and Public Information ...................................................

...........................................................................................................................................

.......................................................................................................................................

................................................................................................................................

................................

.................................................................................

.....................................................................................................................

..................................................................

.....................................................................................................................................

.......................................................................................

.........................................................................................................

91
 

Public affairs 91
 

Elected officials 96
 

Community liaisons 97
 

Community engagement, relationships, and public information lessons learned 98
 

9. Post-Event Responder and Victim Welfare 101
 

Responder mental health 104
 

Post-event responder and victim welfare lessons learned 105
 

Conclusion 109
 

Abbreviations, Acronyms, and Initialisms 111
 

Appendix A. Lessons Learned 113
 

Appendix B. Analysis of San Bernardino City Unified School District After Action Report Data on the
 

Impact of the December 2, 2015 Terrorist Attack........................................................................

.................................................................................................................................................

.................................................................................................................................................

..................................................................................................................................................

......................................................................................

............................................................................................................................................

............................................................................................................................................

.........................................................................................................................

...........................................

121
 

Context 121
 

Method 121
 

Results 124
 

Interpretation/discussion/recommendations 133
 

Conclusion 134
 

References 135
 

About the Authors 137
 

San Bernardino Critical Response project team (subject matter experts) 137
 

Police Foundation project staff ............................................................................................................

..........................................................................................................

...................................................................................................................

139
 

About the Police Foundation 140
 

About the COPS Office 141
 

vi Bringing Calm to Chaos: The San Bernardino Public Safety Response 
 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

Letter from the Director 

of the COPS Office 

Dear colleagues, 

As many of us watched events unfold after the terrorist attack in San Bernardino in December 2015, 

there was one source of reassurance in those dark hours: the exemplary response of the police department, sheriff’s department, probation department, emergency services, and FBI, who all came together 

to prevent additional deaths and injuries. 

There is much to be learned from the response to this tragic event. One important takeaway is that the 

responding agencies were well prepared. Many responders noted that their preparation was due in 

large part to lessons learned from previous critical incident reports. This acknowledgement highlights 

the importance of documenting lessons learned, which can be of great value not only to the agency 

which experienced the event but to other agencies as well. For this reason, the Police Foundation, in 

coordination with the COPS Office, conducted a critical incident review of the shooting and surrounding 

events. By examining the public safety response of the December 2015 attack, this report provides additional lessons learned from all aspects of the event, including the aftermath. 

As was demonstrated in San Bernardino, a detailed review can be of great value to a law enforcement 

agency, enabling significant improvement of policies, procedures, systems, and relationships. It can also 

help other public safety agencies prepare for mass casualty incidents. Through after action assessments 

such as these, the U.S. Department of Justice and its partners can disseminate critical lessons learned to 

the entire field, enabling comprehensive preparation and response and potentially saving lives. 

vii 
 

 

 

 

 

 

 

 

 

 

 

Our thanks go out to the many organizations whose members responded so bravely at the time of the 

attack, especially to those who willingly relived this painful event to share their experiences and offer 

recommendations that can help other agencies in the future. All of them are to be acknowledged for 

their valuable contributions to public safety. 

I encourage all law enforcement and public safety leaders to consider the lessons learned in San Bernardino and how they can be applied to their own agencies. Terrorist activities and other mass casualty 

events are rare, but as we have seen in Orlando, Paris, and other locales, they are unfortunately becoming more common—almost always without warning. And as we saw in San Bernardino, advance preparation can be of enormous help in the midst of tragedy and chaos. 

Sincerely, 

Ronald L. Davis 

Director 

Office of Community Oriented Policing Services 

viii Bringing Calm to Chaos: The San Bernardino Public Safety Response 
 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

Letter from the President
 

of the Police Foundation
 

Dear colleagues, 

As the retired chief of police of the Redlands (California) Police Department, I understand the impact 

critical, high-profile incidents have on a community and a police department. The terrorist attack in 

San Bernardino, California, on December 2, 2015, was unlike anything I experienced during my 33 

years in the Redlands Police Department. On that day, the city of San Bernardino was the site of the 

world’s most recent terrorist attack—and the first on American soil since the bombings at the Boston 

Marathon in 2013. 

Two individuals opened fire indiscriminately—shooting 36 innocent people (killing 14 and injuring 22)— 

as part of a vicious and premeditated terrorist attack at the Inland Regional Center before escaping and 

then returning to San Bernardino to engage in a final shootout that ended their lives. 

The challenges confronting the principal public safety agencies that responded to this attack were 

monumental: three crime scenes; multiple local, state, and federal agencies arriving with sometimes 

overlapping roles and responsibilities; hundreds of victims and witnesses; differing policies and practices, different organizational cultures, using different communications systems and protocols; and 

a nation and world watching and waiting for answers. The fluidity of every aspect of the attack and 

its aftermath required decisions to be made on the spot, in less than opportune situations, with the 

media—and social media—broadcasting every move in real time. 

Bringing new advances to policing lies at the core of the Police Foundation’s mission. Central to our 

research and work with law enforcement agencies is the idea that it is imperative to examine, analyze, 

and learn from police-involved critical incidents in an effort to continually improve. Certainly, that is 

true of this incident. 

Those who responded on that day did so with the utmost bravery and dedication, and their welltrained and disciplined actions undoubtedly saved lives. It is because of the efforts of all involved in 

the response on December 2, 2015, that there were not more victims and that the two terrorists were 

killed before they could inflict more damage and devastation. In fact, many of the lessons learned in this 

report are based on policies, procedures, and protocols that responding agencies followed on that day. 

This review is not meant to assign fault to any individual or agency where improvements are suggested 

but to apply lessons to enhance the safety of first responders and the public at large and to further aide 

in bringing calm to chaos. 

ix 
 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

I am grateful to San Bernardino Police Chief Jarrod Burguan and the professionals at the San Bernardino 

Police Department and to San Bernardino County Sheriff John McMahon and the professionals at the 

San Bernardino County Sheriff’s Department for their cooperation. Not only were they willing to answer 

our questions, provide us access to their departments and information, and provide us unwavering support but they also invited our team and our investigation into the response to these attacks in an effort 

to help advance policing and specifically the response to terrorist attacks. 

It is extremely important to acknowledge the dedication and professionalism of the many law enforcement and first responder agencies involved in this incident. In addition to the San Bernardino Police 

Department and the San Bernardino County Sheriff’s Department, the Redlands Police Department, 

San Bernardino County Probation, Inland Valley Regional SWAT, San Bernardino City Unified School 

District, Ontario Fire Department, San Bernardino City Fire Department, Inland Counties Emergency 

Medical Agency, California Highway Patrol, Fontana Police Department, Colton Police Department, 

Rialto Police Department, San Bernardino County District Attorney’s Office, FBI, ATF, DHS all performed 

their duties valiantly. 

In addition, I am extremely grateful to the hundreds of commanders, supervisors, detectives, officers, 

deputies, other first responders, and victims and witnesses who generously gave us their time. They 

answered all questions candidly, and I am forever thankful for their willingness to relive their stress and 

heartbreak through the retelling of their experiences and the rehashing of traumatizing moments. It was 

only through their eyes that we were able to gain a true understanding of the complexities involved 

throughout that fateful day. 

I would like to express my gratitude for the hard work of our review team: Sheriff Rod Hoops (ret.), 

Chief Rick Braziel (ret.), Chief Frank Straub (ret.), PhD, and George Watson. In addition, I would like to 

thank our Police Foundation staff, including Program Director Jennifer Zeunik for driving the activities 

of this effort as well as Blake Norton, James Burch, Ben Gorban, Rebecca Benson, Joyce Iwashita, and 

Maria Valdovinos. They worked tirelessly to present this critical incident review in a compelling and 

useful manner. 

Finally, this review is dedicated to the victims and families of the victims affected by this terrible 

attack and to victims of terrorism worldwide. It is offered in memory of Robert Adams, Isaac Amanios, 

Bennetta Bet-Badal, Harry Bowman, Sierra Clayborn, Juan Espinoza, Aurora Godoy, Shannon Johnson, 

Larry Daniel Kaufman, Damian Meins, Tin Nguyen, Nicholas Thalasinos, Yvette Velasco, and Michael 

Wetzel. May we remember them and honor them by diligently applying the lessons learned. 

Sincerely, 

Chief Jim Bueermann (ret.) 

President 

Police Foundation 

x Bringing Calm to Chaos: The San Bernardino Public Safety Response 
 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

Acknowledgements
 

The authors of this report wish to thank Director Ronald L. Davis; Robert E. Chapman; Matthew C. 

Scheider, PhD; Jessica Mansourian; and all of the staff of the Office of Community Oriented Policing 

Services who supported this effort and without whom this report would not have been possible. 

We would also like to thank the following Police Foundation staff for their continued support 

and assistance: 

• Jim Bueermann, President 

• Blake Norton, Vice President and Chief Operating Officer 

• James Burch, Vice President 

• Jennifer Zeunik, Director of Programs 

• Rebecca Benson, Senior Policy Analyst 

• Ben Gorban, Policy Analyst 

• Joyce Iwashita, Project Assistant 

• Maria Valdovinos, Research Associate 

Thank you to Chief Jarrod Burguan, Sheriff John McMahon, and all of the San Bernardino Police Department and San Bernardino County Sheriffs’ Department professionals who supported our review process. 

These thanks extend to each of the local, state, and federal public safety agencies and first responders, 

victims, community members, and organizations who provided us unfettered access into the happenings 

of December 2, 2015. 

Thank you to Don Kester with the National Tactical Officers Association for his review and input. 

xi 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

Executive Summary
 

Introduction 

On December 2, 2015, at 10:59 a.m. the Inland Regional Center (IRC) in San Bernardino, California, came 

under attack. The incident began as what is now known to be two shooters, dressed in all black, entered 

the IRC —a building in which San Bernardino County Environmental Health Department employees were 

meeting—and began shooting. 

An intensive and chaotic search for the shooters began initially within the vast IRC complex and then in 

the city and surrounding areas. During the initial and subsequent witness interviews, law enforcement 

received differing accounts of the number of individuals—including shooters— involved in the attack. 

Quick investigative work by a San Bernardo Police Department (SBPD) civilian analyst and the San Bernardino County Sheriff’s Department (SBCSD) Criminal Intelligence division developed an address for 

one of the shooters: Rizwan Farook (the male assailant). Before long, officers located the suspect vehicle 

and two suspects, which led to a midday shootout between the police and Rizwan and his wife Tashfeen 

Malik (the female assailant), as well as a search for a third subject some officers believed had fled the 

suspects’ vehicle. Ultimately, law enforcement officers killed both assailants on a normally quiet residential street—but not before two officers were wounded. It was later determined that there was not a 

third suspect. 

The aftermath of the gun battle was witnessed in real time across the country as news helicopters hovered overhead. Press conferences were held throughout the day and evening as well as for several days 

following the attack as authorities attempted to quell rising fears and investigators scoured the region, 

as well as the Internet, in search of clues to determine why the couple had committed such a brutal 

attack that ultimately left 22 civilians wounded, 14 civilians dead, and 2 officers injured. 

Two days later, the answer came: a premeditated act of terrorism. San Bernardino had joined the ranks 

of New York City; Washington, D.C.; Paris; and Brussels as cities that have all dealt with extreme violence 

at the hands of terrorists. 

Implications and challenges 

As the nation and the world watched, local, county, state, and federal law enforcement, fire, emergency 

medical services (EMS), and other medical personnel rushed to San Bernardino to assist in the response 

to the world’s latest terrorist attack. 

The challenges confronting the responding agencies were immense. There were three separate sites 

that posed danger to the community and required immediate response and investigation: the IRC, 

where the original shooting occurred; the roadway where the final shootout occurred; and the terrorxiii 
 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

ists’ apartment. A significant and coordinated response between federal, state, and local authorities 

was initiated to secure the scenes, identify and locate the shooters, treat and transport the injured, and 

investigate the crime scenes. 

Simultaneously, officials engaged the media and provided timely and accurate information to calm the 

community while at the same time protecting the victims, their families, and the increasingly complex 

investigation of the terrorist attacks. 

Addressing these challenges in addition to all the others that arise during an incident of such magnitude 

as well as the traditional daily workload that does not abate during critical incidents was a monumental 

task. Public safety personnel responded with the utmost bravery and dedication. Their actions neutralized the terrorist threat and saved the lives of many more innocent people. 

In addition to learning about the courage of the individuals who put their lives on the line to ensure 

that others did not lose theirs, other valuable lessons can be learned from the response to the terrorist 

attack in San Bernardino. The purpose of this Office of Community Oriented Policing Services (COPS 

Office) Critical Incident Review is to critically, objectively, and thoroughly examine the public safety 

response—including preparation and aftermath—to the December 2, 2015, terrorist shooting in San 

Bernardino. This review provides a detailed overview of the incident response; lessons learned to 

improve responding agencies' policies, procedures, tactics, systems, culture, and relationships; and 

guidance to other agencies and first responders as they prepare for responses to terrorist, active shooter or other hostile events, or mass casualty incidents. 

It is important that the lessons identified in this report be studied and applied by public safety agencies 

as they work to enhance the safety of their community and first responders and possibly prevent future 

attacks. 

Key themes of the review 

This COPS Office Critical Incident Review completed by the Police Foundation team attempts to give 

a regional view of the response from the perspective of the first responders and identifies lessons 

learned before, during, and after the terrorist attack. The lessons learned are identified as they relate 

to the response in San Bernardino but are applicable to active shooter or hostile events more generally. They center on leadership; command and control; planning and response; investigations; community engagement, relationships, and public information; and responder and victim welfare and 

mental health. 

xiv Bringing Calm to Chaos: The San Bernardino Public Safety Response 
 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

Some of the key themes include the following: 

Build relationships—leader to leader, organization to organization, police to community—prior to 

a critical incident. During response, leverage relationships, be inclusive, and publicly acknowledge 

those relationships. Overwhelmingly, responders interviewed attributed much of the success of the 

response to the December terrorist attacks to the relationships they had built regionally through 

training and other endeavors. Organizational leaders showed a united front in formulating and 

implementing a response to the attack even under the most uncertain of circumstances. Commanders included individuals from varying units at varying levels in briefings and decision making. 

Responders from various agencies with differing priorities and protocols worked together to clear 

and investigate three different scenes. When there were complications, pre-existing relationships 

ameliorated tension and enabled resolution. 

Lessons learned related to relationship building include 4.3 (on page 56), 4.6 (on page 57), 7.1 (on page 

89), 7.2 (on page 89), 7.3 (on page 89), 8.2 (on page 98), and 8.5 (on page 99). 

•	 Review, study, and apply lessons learned from critical incident reviews. San Bernardino area 

first responders and leaders studied and applied collective lessons learned from critical incident 

reviews, including the 2013 review of the attacks by Christopher Dorner.

1 The resulting adjustments to response protocols improved their coordination and response to the San Bernardino terrorist attacks. The ability to critically analyze incident response, identify areas of improvement, and 

make adjustments to protocol and practice is key to strengthening response not only locally but also 

for public responders nationwide. 

Lessons learned related to applying lessons learned include 4.2 (on page 56), 5.1 (on page 62), and 5.3 

(on page 63). 

•	 Regional public safety partners should plan and exercise unified command for complex incidents 

on a regular basis. The application of a unified incident command structure (ICS) protocol is necessary to manage large scale active shooter or other hostile events. For that reason, consistent preparation through training and implementation during routine events and emergencies is important so 

the use of ICS becomes a normal aspect of an agency’s response to incidents. 

Lessons learned related to understanding and implementing incident command structures include 5.2 

(on page 62), 5.3 (on page 63), 5.4 (on page 63), 5.5 (on page 63), and 5.8 (on page 64). 

1 Police Under Attack: Southern California Law Enforcement Response to the Attacks by Christopher Dorner 

(Washington, DC: Police Foundation, 2013), http://www.policefoundation.org/critical-incident-reviewlibrary/police-foundation-regional-review-of-police-response-to-the-attacks-by-christopher-dorner/. 

Executive Summary xv 
 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

•	 Conducting regional multiorganizational training improves response. Both responders and victims 

to the terrorist attacks in San Bernardino reported that active shooter training had taught them the 

skills they needed to protect themselves and others. For the public, active shooter training should 

be planned and should not be a surprise to trainees. For public safety officers, training should simulate high-stress situations and prepare them to identify and protect against secondary devices. 

Training should be inclusive, involving not only public safety agencies but also the medical community, legislators, other governmental organizations, faith leaders, mental health providers, and others. 

Training should extend past the initial response into transition to victim extraction and all the way 

through family notifications. 

Lessons learned related to conducting regional multidiscipline training include 4.4 (on page 57), 6.1 

(on page 76), 6.3 (on page 77), 6.5 (on page 77), 6.6 (on page 77), 6.7 (on page 78), 6.8 (on page 78), 

6.9 (on page 78), 6.10 (on page 79), 6.11 (on page 79), 6.16 (on page 80), 6.24 (on page 82), and 8.3 

(on page 98). 

•	 Prepare and use equipment and technology to keep officers and community members safe and 

informed. Agencies should ensure that their departments have the equipment and technology necessary to protect and inform their communities and themselves in active shooter or other hostile 

events. Officers should be given adequate personal protective gear and tactical emergency medical 

kits to best prepare for mass casualty events. Communications systems should be load tested. The 

use of social media and other contemporary communications strategies, when established prior to 

the critical incident, allows public safety agencies to ensure the information put out the public is 

accurate and timely. In addition, technology such as designated encrypted public safety communication channels and armored vehicles, when used under proper policy and authority, can protect 

officers and the public in critical incidents. 

Lessons learned related to the use of equipment and technology include 6.15 (on page 80), 6.17 (on 

page 80), 6.19 (on page 81), 6.21 (on page 81), 6.25 (on page 82), 6.28 (on page 83), 6.29 (on page 83), 

6.30 (on page 83), 6.31 (on page 83), 8.1 (on page 98), 8.3 (on page 98). 

•	 Attend to community, victim, and officer wellness. Active shooter or other hostile events are devastating to a community, to the victims, and to public safety personnel responding to them. It is 

critical that departments plan and work with mental health, faith, and other partners to accommodate victims and witnesses and provide resources necessary to heal from the incident. It is also 

imperative that departments underscore this need and provide debriefings and other mental health 

resources to all personnel both immediately following and long after the event. 

Lessons learned related to wellness include 4.1 (on page 55), 4.5 (on page 57), 7.4 (on page 89), 8.6 (on 

page 99), 8.7 (on page 99), 8.8 (on page 99), and all chapter 9 recommendations (on pages 105–108). 

xvi Bringing Calm to Chaos: The San Bernardino Public Safety Response 
 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

Conclusion 

San Bernardino area public safety organizations responded to the December 2 terrorist attacks with the 

utmost bravery and professionalism. Their actions that day saved lives. Many of the decisions made by 

organizational leaders and steps taken by responders to prepare for, respond to, and recover from the 

incident can set an example for other organizations as they plan to protect their communities against a 

similar type of attack. Lessons learned in this document are based on those policies, practices, and protocols that helped create a successful response to the terrorist shootings; they also focus on 

areas of improvement. 

We are thankful to the San Bernardino area public safety leaders, responders, and professionals; federal, state, and local partners; victims and their families; and the entire San Bernardino and surrounding 

community for their openness and honesty in telling their stories and rehashing the details of the incident through this review process. Without their willingness to discuss and provide painful details as well 

as to allow us access to important information and data, we could not have developed this report. 

Many of the lessons learned during the response on December 2, 2015, continue to build on the body 

of knowledge that exists to assist law enforcement agencies in their mission to protect and strengthen 

relationships with their community. Many of the lessons tie into the principles of community policing. 

As the Police Foundation continues to work to advance policing through innovation, it is no surprise that 

the lessons learned on that day tie to the ideals of 21st century policing. 

We hope that the lessons learned in this report and the critical response as a whole will add to the growing body of literature that public safety agencies can use to enhance their preparation for and response 

to active shooter or other hostile events including future terrorist attacks. 

Executive Summary xvii 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

Section I. Introduction and Background 

Introduction 

On December 2, 2015, San Bernardino County employees at the Inland Regional Center (IRC) in San Bernardino, California, were gathering for a training meeting.

2 Syed Rizwan Farook (the male assailant), a 

county environmental health specialist, was in attendance but left the building during the meeting. He 

and his wife, Tashfeen Malik (the female assailant), later returned to the building dressed in dark tactical 

military-style gear and unleashed terror on his coworkers and others along the way. In a matter of 

minutes, the couple fired more than 100 .223 rounds, wounding 22 and killing 14 before they fled in a 

rented SUV. 

The first officer arrived on scene three minutes and 32 seconds after the first computer-aided dispatch (CAD) call went out. Four hours later, the couple engaged officers in a gun battle that ended the 

assailants’ lives.

3 In those chaotic hours, multiple local, state, and federal law enforcement agents, 

firefighters, and medical personnel responded to three separate scenes (the IRC, the officer-involved 

shooting scene, and the assailants’ residence). They collectively sought to secure the scenes, treat and 

transport the injured, investigate the incidents, address the media and the public, and identify and 

locate the assailants, all while facing threats of secondary attacks and possible explosive detonations. 

The preliminary investigation that followed revealed that the assailants planned, targeted, and attacked 

the male assailant’s coworkers in an act of terrorism. 

2 Many media outlets reported that employees were gathering for a holiday party. The conference center room in 

the IRC was decorated for the holidays, and the employees were both attending training and holding a holiday 

party. 

3 Times are derived from timeline provided by the San Bernardino County Sheriff’s Department. 

The COPS Office Critical Response Technical Assistance 

The Office of Community Oriented Policing Services (COPS Office) established the Critical Response 

Technical Assistance (CRTA) program in 2013 to provide targeted technical assistance to law enforcement agencies dealing with high-profile events, major incidents, or sensitive issues of varying need. 

1 
 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

The purpose of this COPS Office CRTA Critical Incident Review is to critically, objectively, and thoroughly 

examine the public safety response—including preparation and aftermath—to the December 2, 2015, 

terrorist incident. This review will 

•	 provide a detailed overview of the incident response; 

•	 identify ways to improve the responding agencies' policies, procedures, tactics, systems, culture, 

and relationships; 

•	 provide guidance to other agencies and first responders as they plan and train for responses to terrorist, active shooter, or mass casualty incidents. 

“We really are going to objectively review the entirety of the law 

enforcement response [to] ultimately develop lessons learned that law 

enforcement nationwide can use to help prepare.” 

— Robert E. Chapman, Deputy Director, Office of Community Oriented 

Policing Services, “San Bernardino Police Are Praised for Attack 

Response But Know Not Everything Went Smoothly,” Los Angeles Times, 

February 3, 2016 

Scope andgoals of review 

This report will focus on the public safety response—including the many agencies and officers who 

responded to the scene—and the preliminary phases of the investigation. The assessment begins with 

the initial reports of gunfire on December 2, 2015, and extends through the search for and engagement 

of the assailants, the investigation of multiple crime scenes, and the aftermath. Reviewing every aspect 

of the incident response allows for a robust discussion of how decisions made and actions taken affected subsequent events and provides opportunities to identify lessons learned that may improve public 

safety responses. 

The goal of this report is to critically assess the decisions made and the actions taken in response to the 

terrorist attacks—not in judgment but in careful study. We hope that this study will provide information 

that will ultimately facilitate of officers developing “skills and knowledge necessary in the fight against 

terrorism by gaining an understanding of the links between normal criminal activity and terrorism, for 

example.”4 This report will touch on the transition from the early response to when the incident was 

officially deemed terrorism and how the responding agencies worked together throughout the process. 

4 President’s Task Force on 21st Century Policing, Final Report of the President’s Task Force on 21st Century Policing 

(Washington, DC: Office of Community Oriented Policing Services, 2015), 52, 

http://www.cops.usdoj.gov/pdf/taskforce/TaskForce_FinalReport.pdf. 

2 Bringing Calm to Chaos: The San Bernardino Public Safety Response 
 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

The response of San Bernardino public safety agencies was exemplary in many ways. The men and 

women of those agencies responded with bravery and discipline in the midst of chaos. Their efforts 

undoubtedly saved lives and ended the devastation caused by the terrorists. Every critical incident is 

unique and the circumstances challenging. Every critical incident review and after action review presents 

an opportunity to strengthen training and procedures to protect communities and first responders. 

Lessons learned from the Police Foundation review of the Christopher Dorner incident in 2013 contributed to the response to the December 2 terrorist shooting at the IRC. In February 2013, former Los 

Angeles Police Department (LAPD) Officer Christopher Dorner stalked and executed family members of 

LAPD staff for what he claimed had been unfair treatment resulting in his eventual termination. His first 

victims included the daughter of a retired LAPD captain and her fiancé, himself a police officer. Dorner 

eventually wounded three officers and killed two law enforcement officers (a Riverside Police Department officer and a San Bernardino County sheriff’s deputy) in three separate ambushes before 

he died in a cabin about 30 minutes east of San Bernardino. Following the Dorner incident, San Bernardino area agency leaders held monthly meetings to work through some of the specific challenges 

identified in the critical incident review.

5 Those challenges included self-deployment, disparate training, and poor communication. The relationships built thereafter remained strong and contributed to 

smooth collaboration between multiple agencies during the December 2 terrorist attack. Many of 

the public safety leaders involved in both the Dorner response and the San Bernardino response found 

that because they had thoroughly studied and addressed the challenges identified in previous reviews, 

their response to the terrorist attack was improved. During the December 2, 2015, attacks, officers from 

different departments grouped together instantly and entered the IRC, self-deployment was more controlled by local protocols, and area leadership had pre-existing relationships that allowed them to make 

decisions quickly. 

The report is intended to provide a learning tool for analyzing the public safety response and highlighting what worked and what processes should be re-evaluated and modified. It focuses on active shooter 

or other hostile events, planning and preparation, tactical response, community engagement, relationships, and public affairs, command and control, post-event victim and witness welfare, first responder 

wellness and mental health, and post-event investigation and leadership issues. The lessons learned 

here can serve public safety agencies throughout the country as they prepare for active shooter or other 

hostile events that require a coordinated interagency response to an ongoing incident. Lessons learned 

can and should help guide training and the development of new response protocols for possible future 

events. This report is not a critique. Rather, it is a learning document designed to critically assess the 

public safety response to a terrorist incident, the likes of which we continue to see in the United States 

and throughout the world. 

5 Police Under Attack (see note 1). 

Introduction 3 
 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

Just as other critical incident reviews have been used to guide policies, procedures, operations, and 

training, this critical study and review should assist public safety agencies in enhancing their response 

and limit the impact of future active shooter or other hostile events. 

National and international implications 

As demonstrated by the Boston Marathon bombings in 2013, the terrorist bombing and shootings 

in Norway in 2011, the coordinated terrorist attacks in Paris in 2015 prior to the attack in San Bernardino, the terrorist attacks in Brussels in 2016, and attacks in other countries—it is likely communities 

across the United States and their responding public safety agencies will continue to experience violent 

extremism and other active shooter or other hostile events. 

Not learning from the challenges and promising practices identified in the aftermath of those horrific 

events would be a disservice to the responders and a dishonor to the victims. The critical analysis of 

every aspect of the San Bernardino response is intended to add to a growing body of literature that 

national and international public safety agencies can use to prepare for active shooter or other hostile 

events. In addition, as the tactics and strategies employed by violent extremists and other terrorists 

continue to evolve, incident reviews will help public safety officials and their communities prepare for 

future attacks. 

Report organization 

Chapter 1 details the methodology used to conduct the review and analysis outlined in this report. 

Chapter 2 includes background information on the city and county of San Bernardino, including environmental factors such as the geography and demographics of the city and surrounding areas and 

background information on the public safety agencies that responded to the incident. Chapter 3 provides details and chronology of the event and subsequent investigation. Chapters 4 through 9 focus on 

issues that impacted the response, including leadership; command and control; planning and response; 

investigations; community engagement, relationships, and public information; and post-event responder and victim welfare. Each of these chapters provides information on the identified topic or topics as 

well as important findings and critical lessons learned in those categories. The conclusion of this report 

summarizes the key themes, giving direction to which topics need further study and enhancement within mass casualty preparations and highlighting what changes have already begun to take place following 

the attack in San Bernardino and other recent events. 

4 Bringing Calm to Chaos: The San Bernardino Public Safety Response 
 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

1. Methodology
 

In January 2016—at the request of and with the assistance of the San Bernardino Police Department 

(SBPD), the San Bernardino County Sheriff’s Department (SBCSD), and other responding public safety 

agencies and under the direction of the U.S. Department of Justice, Office of Community Oriented 

Policing Services (COPS Office)—the Police Foundation (PF) created a Critical Incident Review team.6 

The team, comprising subject matter experts in public safety and critical incident response, developed 

and executed a comprehensive methodology to critically review and assess the public safety response to 

the December 2, 2015, San Bernardino terrorist attacks. From February through April 2016, team members collected, analyzed, reviewed, and consulted with field experts to capture intricate details of the 

San Bernardino response. Understanding how decisions in the field improved or impaired the response 

process required a thorough examination of a plethora of information from a variety of sources. Sources 

and types of information included site visits to locations in the San Bernardino area where incidents 

occurred; visits to responding agencies; focus groups and round tables to identify common successes 

and concerns; interviews with individuals, including first responders to the attack (law enforcement, 

medical, fire, and city officials), victims, community members and other key stakeholders to gain individual perspectives from those involved; document reviews; and literature and media coverage reviews. 

The following sections detail the assessment team’s methods during the data-gathering phase. 

6 Team member bios can be found at the end of this report. 

Data collection 

On-site datacollection 

The team conducted three site visits: February 1–5, 2016; February 15–19, 2016; and March 14–18, 

2016. During these visits, they conducted individual interviews and focus groups, visited the Inland 

Regional Center (IRC) and the other facilities that played integral roles in the hours and days after the 

attack, and collected documentation and data. 

5 
 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

Confidential interviews. During site visits, the team conducted interviews with more than 200 individuals involved in the December 2 attacks, including dispatchers, patrol officers, and public safety executives and managers; federal, state, and local personnel; medical responders; special weapons and tactics 

(SWAT) team members; victims and their families; and community and faith leaders. 

Those interviewed included the following: 

• Baitul Hameed Mosque leadership 

• California State University San Bernardino campus police chief 

• Counseling team representatives 

• Federal Bureau of Investigation assistant director in charge, Los Angeles 

• Rancho Cucamonga fire chief 

• Redlands Chamber of Commerce members 

• Redlands fire chief 

• Redlands police chief 

• San Bernardino Board of Supervisors chairman 

• San Bernardino City Chamber of Commerce members 

• San Bernardino City fire chief 

• San Bernardino County Coroner’s Division 

• San Bernardino County Emergency Operations director 

• San Bernardino County Fire Department Emergency Operations director 

• San Bernardino County sheriff 

• San Bernardino County Sheriff’s Department command personnel 

• San Bernardino County Sheriff’s Department executive staff 

• San Bernardino County Sheriff’s Department first responders 

• San Bernardino County Sheriff’s Department Specialized Investigations Division 

• San Bernardino District Attorney 

• San Bernardino District Attorney victims advocate 

• San Bernardino police chief 

6 Bringing Calm to Chaos: The San Bernardino Public Safety Response 
 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

•	 San Bernardino Police Department command personnel 

•	 San Bernardino Police Department executive staff 

•	 San Bernardino Police first responders 

•	 San Bernardino Police Specialized Unit personnel 

•	 San Bernardino City Unified School District Police Department chief 

Focus groups / Round tables. In addition, the team conducted focus groups and round tables with 

groups of individuals including first responders and victims. Because there were more than 400 witnesses at the IRC and countless first responders from agencies across southern California, the focus groups 

afforded the team the opportunity to meet with as many people as possible and identify common 

trends, successes, and concerns. The team identified comfortable, accessible locations to meet with 

groups of varying sizes (ranging from groups of four to 20 people or more) to discuss shared experiences 

in relation to the attacks. 

Focus groups and round table participants included the following: 

•	 Arrowhead Regional Medical Center emergency room doctors (the lead emergency room 

doctors during the response) 

•	 December 2, 2015, terrorist attack victims and families 

•	 Fontana Police Department responders 

•	 Inland Regional SWAT team 

•	 Redlands Police Department detectives 

•	 Redlands Police Department first responders 

•	 Redlands Police Department SWAT team 

•	 San Bernardino County District Attorney’s Office 

•	 San Bernardino County Probation Department responders 

•	 San Bernardino County Public Health Department deputy director 

•	 San Bernardino County Sheriff’s Department Coroner’s Division 

•	 San Bernardino County Sheriff’s Department Specialized Investigations Division 

•	 San Bernardino County Sheriff’s Department first responders (including patrol, dispatch, 

and aviation) 

1. Methodology 7 
 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

•	 San Bernardino County Sheriff’s Department Public Affairs 

•	 San Bernardino County Sheriff’s Department Scientific Investigations Division (SID) 

•	 San Bernardino County Sheriff’s Department SWAT team/bomb techs and dog handlers 

•	 San Bernardino Fire Department first responders 

•	 San Bernardino Police Department dispatch 

•	 San Bernardino Police Department first responders 

•	 San Bernardino Police Department Narcotics officers 

•	 San Bernardino Police Department SWAT team 

•	 San Bernardino City Unified School District Police Department 

Other meetings and on-site activities. While on-site the team also took the opportunity to attend other 

relevant meetings, conduct direct observations, and tour relevant facilities as a way to further delve into 

the details of the response to the December 2 terrorist attack. The PF team 

•	 attended the Joint Legislative Committee on Emergency Management hearing on “The San Bernardino Incident: Lessons Learned,” hosted by Assemblyman Freddie Rodriguez (D-Chino) on March 18, 

2016; 

•	 conducted ride-alongs and tours of relevant incident locations, including the IRC; 

•	 conducted direct observation of responding public safety agencies’ day-to-day operations. 

Materials collection and review. Through materials requests to responding agencies as well as collection of materials while on site, the team collected hundreds of documents, videos, photos, audio files, 

and other forms of data from agencies and departments involved in the response to the December 2 

terrorist attack at the IRC. Review of these documents assisted in highlighting best practices and identifying gaps that served as the foundation of key focus areas to address when planning and preparing a 

response to mass casualty events. 

Materials reviewed included the following: 

•	 After action reports 

•	 Audio and video files 

•	 Bus passenger list 

•	 Call history details 

•	 Crime scene photos 

•	 Crime scene reports 

•	 Evidence reports 

8 Bringing Calm to Chaos: The San Bernardino Public Safety Response 
 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

• Eyewitness statements 

• Field officer notes 

• IRC post-incident building assessment 

• Law enforcement weapons used lists 

• Patrol and SWAT team reports 

• Relevant department policies, procedures, and manuals 

• Social media content and statistics 

• Supplemental reports 

• Suspect information 

• Tips 

• Training documentation including curricula and schedules 

• Training outlines 

• Victim reports and statements 

• Waterman repopulation plan 

• Witness lists 

• Witness officer interview reports 

Off-site datacollection 

In addition to the information collected while on site, the team collected relevant literature and media 

to further analyze the response to the San Bernardino terrorist attacks and to assess national best practices as they relate to the response to the San Bernardino terrorist attacks. 

Literature review. In an effort to ground the incident review in national standards, model policies, and 

best practices, the PF team reviewed documentation on incident response, the National Incident Management System (NIMS), active shooter incidents, and mass casualty response published by nationally 

recognized organizations including the following: 

• U.S. Department of Homeland Security (DHS) 

• U.S. Department of Justice (DOJ) 

• Federal Emergency Management Agency (FEMA) 

• The InterAgency Board (IAB) 

• International Association of Chiefs of Police (IACP) 

1. Methodology 9 
 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

• International Association of Fire Fighters (IAFF) 

• National Tactical Officers Association (NTOA) 

• Police Executive Research Forum (PERF) 

• Police Foundation (PF) 

Media analysis. The San Bernardino attacks were reported on television, the Internet, and social media 

as they were taking place. The team reviewed hours of open-source video footage and social media 

postings, read articles, and listened to relevant audio regarding the incident. 

Analysis 

The PF, in consultation with the COPS Office, used the information collected to identify areas of focus to 

develop the foundation for lessons learned. They began by reviewing the planning, protocols, training, 

and preparation for critical incident events in the San Bernardino region. They identified challenges and 

successes in the response and investigation of the December 2015 terrorist incident through interviews 

and other data collection methodology. They analyzed the engagement and communication with the 

community before, during, and after the incident response. Based on this information as well as best 

practices, model policies, and evidence-based protocols, the team produced a gap analysis in each of the 

focus areas. 

Development of lessons learned 

The analysis of key focus areas provided a foundation from which to develop a set of lessons learned to 

be used by public safety agencies and communities across the nation and worldwide as they plan for 

terrorist or active shooter or other hostile events. It should be noted that the lessons learned in this 

document are based not only on areas of improvement for responding agencies but also on those policies, practices, and protocols that helped create a successful response to the terrorist shootings that 

occurred at the IRC on December 2, 2015. 

10 Bringing Calm to Chaos: The San Bernardino Public Safety Response 
 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

2. Incident Context and
 

Background Information
 

Geography 

San Bernardino, California , and t hesurrounding area 

The city of San Bernardino was first settled in 1851.

7 It is located in the lower region of the San Bernardino Valley in southern California, about 60 miles east of Los Angeles. The city is about 60 square miles 

and has a population estimated at 216,108 as of July 1, 2015.

8 The area includes “approximately 19 

miles of wildland interface area, a major rail yard, an international airport, the County Seat, a jail, two 

major mall complexes, and three major interstate freeways.”9 

San Bernardino County is the largest county in the contiguous United States by area with more than 

20,000 square miles of land.10 With more than two million people, San Bernardino County is the fifth 

most populous county in California and the twelfth most populous county in the United States.

11 About 

80 percent of the county is vacant land, so residents are concentrated in a fraction of the large jurisdiction. Most San Bernardino County residents are White, young, and middle-income. From the U.S. Census 

Bureau’s 2014 estimates, about 77.3 percent of the County’s population is “White alone” and 30.6 percent is “White alone, not Hispanic or Latino.” 

7 “History of San Bernardino,” City of San Bernardino, California, accessed June 23, 2016, http://www.ci.sanbernardino.ca.us/about/history/history_of_san_bernardino_(short_version).asp. 

8 “State and County QuickFacts: San Bernardino city, California,” U.S. Census Bureau, U.S. Department of 

Commerce, accessed April 11, 2016, https://www.census.gov/quickfacts/table/PST045215/0665000,00#tableview. 

9 “San Bernardino City Fire Department Statistics,” City of San Bernardino, California, accessed April 11, 2016, 

http://www.ci.san-bernardino.ca.us/cityhall/fire/sbfd_facts.asp. 

10 Department of Public Health, “Healthy Communities,” San Bernardino County, accessed June 23, 2016, 

http://www.sbcounty.gov/dph/publichealth/programs_services/healthy_communities/healthy_communities.asp. 

11 Community Indicators Report 2015 (San Bernardino, CA: San Bernardino County, 2015), 

http://cms.sbcounty.gov/Portals/21/Resources%20Documents/CIR_2015_Report.pdf, 5–6. 

The population is slightly older than that of San Bernardino 

11 
 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

city, with 27.2 percent of residents under 18 years of age and 10.3 percent 65 years of age or older. 

Slightly more than 20 percent of individuals live below the poverty level, and the median household 

income is $54,100, compared to San Bernardino city’s median household income of $38,774.12 

Ethnically, 60 percent of the city of San Bernardino population reports as Hispanic or Latino.13 Thirty-two 

percent of the entire population is under 18 years old while 7.9 percent are 65 years or older. Thirtythree percent are living below the poverty level.14 

Once, San Bernardino was an all-American city. In fact, in 1976, the National Civil League dubbed it 

exactly that with its annual selection of the nation’s best cities.15 It was the culmination of more than 

a century of development, building a successful blue-collar city. The city prospered, but when a local 

steel mill shut down followed by the closure of the Norton Air Force base, things quickly fell apart. As 

jobs disappeared and gang crime rose, the city became one of the nation’s poorest and most dangerous. 

Finally, the city filed for bankruptcy in 2012, a status it was still in when the December 2 terrorist attack 

occurred. According to the Federal Bureau of Investigation’s (FBI) 2014 Uniform Crime Report, San Bernardino had one of the highest violent crime rates per 100,000 population. In fact, of the 210 mid-size 

cities identified in the report, San Bernardino was ranked among the top ten cities with populations of 

100,000 to 249,999.

16 

12 “State and County QuickFacts: San Bernardino County, California,” United States Census Bureau, U.S. 

Department of Commerce, accessed April 11, 2016, 

http://www.census.gov/quickfacts/table/PST045215/06071#table-view; “State and County QuickFacts: San 

Bernardino city, California” (see note 8). 

13 The census has four race categories (White, Black, American Indian and Alaska Native, and Asian and Pacific 

Islander) and two ethnicity categories, Hispanic and non-Hispanic. “Race: About,” United States Census Bureau, 

last modified July 8, 2013, http://www.census.gov/topics/population/race/about.html; “Race, Hispanic Origin, and 

Ancestry: Why, What, and How,” United States Census 2000 (Washington, DC: United States Census Bureau, 2000), 

https://www.census.gov/dmd/www/pdf/d3249c.pdf. 

14 “State and County QuickFacts: San Bernardino city, California” (see note 8). 

15 “All America City Award: Winning Communities By State,” National Civic League, accessed June 23, 2016, 

http://www.nationalcivicleague.org/previous-all-america-city-winners/#WinningCommunitiesByState. 

16 Mason Johnson, “Violent Crime Statistics For Every City In America,” CBS Chicago, last modified October 22, 

2015, http://chicago.cbslocal.com/2015/10/22/violent-crime-statistics-for-every-city-in-america/; Crime in the 

United States, 2014, Uniform Crime Report (Washington, DC: Federal Bureau of Investigation, 2015), 

https://www.fbi.gov/about-us/cjis/ucr/crime-in-the-u.s/2014/crime-in-the-u.s.-2014. 

12 Bringing Calm to Chaos: The San Bernardino Public Safety Response 
The surrounding area 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

San Bernardino and several surrounding communities make up the area referred to as the Inland 

Empire. Those surrounding communities include the cities of Redlands, Rancho Cucamonga, Ontario, 

Fontana, and Rialto. 

The city of Redlands is the eastern neighbor of San Bernardino and home to approximately 70,000 people.

17 Like many of the communities in the area, Redlands is a bedroom community, funneling workers 

throughout the region. The city's growth was boosted by the agricultural development of citrus groves in 

the late 1800s, enabling Redlands to become one of the nation's top citrus producers for several decades.18 Most of the citrus groves are gone now, replaced by sprawling development as the city's population grew and more housing was needed. Residents have a higher median household income ($67,112) 

than San Bernardino County and are generally older, with a smaller minority representation, a lower 

poverty rate, and more people with high school diplomas and college degrees.

19 The city is home to several thriving businesses, none more so than ESRI, one of the top geographic information systems software companies in the world. 

Rancho Cucamonga is found along the western border of San Bernardino County. The city is located 37 

miles east of downtown Los Angeles with a population of 165,269.20 Its warm Mediterranean climate 

proved useful for agriculture as the city first was formed, with a focus on vineyards for wine production. 

Over time, Rancho Cucamonga evolved into a bedroom community, but like neighboring cities also 

found itself home to a burgeoning logistics industry because of its close proximity to Ontario International Airport, two major freeways, and the coastal shipping industry.21 The city's median household 

income was last recorded at $77,835.22 

17 “State and County QuickFacts: Redlands city, California,” United States Census Bureau, U.S. Department of 

Commerce, accessed April 11, 2016, 

https://www.census.gov/quickfacts/table/PST045215/0659962,0665000,00#table-view. 

18 “Historic Citrus Preservation,” City of Redlands, accessed June 21, 2016, 

http://www.cityofredlands.org/qol/citrus. 

19 “State and County QuickFacts: Redlands city, California” (see note 17). 

20 “State and County QuickFacts: Rancho Cucamonga city, California,” United States Census Bureau, U.S. 

Department of Commerce, accessed June 21, 2016, 

http://www.census.gov/quickfacts/table/PST045215/0659451#table-view. 

21 Paul McAfee, “Region Occupies Pivotal Position on Commercial Lanes,” Citivu.com, reprinted with permission 

from Transportation Services Directory of the Business Press, June 10, 1996, 

http://www.citivu.com/rc/city/tlanes.html. 

22 Ibid. 

2. Incident Context and Background Information 13 
 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

The city of Ontario is in San Bernardino County along the eastern border of Rancho Cucamonga and has 

a population of 163,924.23 Like its neighbors, agriculture played a critical role in the city's development, 

which in addition to citrus and wine included olives. Over time, agriculture waned as the city's economy 

transformed into warehousing and services in large part because of the development of Ontario International Airport.

24 The city's median household income is $54,156.25 

Fontana thrived as a steel-making city before the mill closed down in the early 1980s.26 Today, the bedroom community is home to 196,069 people in San Bernardino County, making it the second-most 

populous city in San Bernardino County behind only San Bernardino city itself. Compared to the population of San Bernardino city, the population of Fontana is younger, is more diverse, and has almost five 

percent more high school graduates or higher and residents with bachelor’s degrees or higher.

27 An auto 

race track was built on the grounds of the shuttered steel mill and has become the city's top attraction. 

The city's median household income is $64,995, almost twice that of San Bernardino city.

28 

The city of Rialto has an area of 28.5 square miles and a population of 99,171 and is found in San Bernardino County. Its residents are slightly younger than those of San Bernardino County in general, with 

more Hispanic and Latino residents, a slightly lower median household income, and a lower likelihood 

of having finished high school or attained a bachelor’s degree or higher.29 The city's primary economies 

are service industries and major regional distribution centers for Staples, Target, Under Armour, and 

Toys-R-Us.30 The city's median household income is $50,277.31 

23 “State and County QuickFacts: Ontario city, California,” United States Census Bureau, U.S. Department of 

Commerce, accessed June 21, 2016, http://www.census.gov/quickfacts/table/PST045215/0653896#table-view.
 

24 “City History,” City of Ontario, California, accessed June 23, 2016, http://www.ontarioca.gov/about-ontario/cityhistory.
 

25 Ibid.
 

26 “Kaiser Ventures,” Wikipedia, last modified May 27, 2016, https://en.wikipedia.org/wiki/Kaiser_Ventures.
 

27 “State and County QuickFacts: Fontana city, California,” United States Census Bureau, U.S. Department of
 

Commerce, accessed June 21, 2016, http://www.census.gov/quickfacts/table/PST045215/0624680#table-view.
 

28 Ibid.
 

29 “State and County QuickFacts: Rialto city, California,” United States Census Bureau, U.S. Department of
 

Commerce, accessed June 21, 2016, http://www.census.gov/quickfacts/table/PST045215/0660466#table-view.
 

30 “About Rialto,” City of Rialto, accessed June 23, 2016, http://yourrialto.com/?page_id=39.
 

31 Ibid.
 

14 Bringing Calm to Chaos: The San Bernardino Public Safety Response 
 

 

 

 

 

 

 

 

 

 

Colton is a San Bernardino County city with 54,152 residents. Its population is slightly younger than the 

general county population and has a higher percentage of Hispanic and Latino residents. Colton residents are also less likely than residents elsewhere in the county to be high school graduates or to have 

bachelor’s or higher degrees, and the median household income is lower than in the county at large. 32 

The city is also home to the Arrowhead Regional Medical Center, a teaching hospital and the second 

busiest emergency room in the state.33 The city's median household income is $39,915.34 

Figure 1 provides a map of the San Bernardino area and the locations of the primary responding agencies to the December 2 terrorist attacks. 

Figure 1. Primary responding agencies 

32 “State and County QuickFacts: Colton city, California,” United States Census Bureau, U.S. Department of 

Commerce, accessed June 21, 2016, http://www.census.gov/quickfacts/table/PST045215/0614890#table-view. 

33 Arrowhead Regional Medical Center—County of San Bernardino (Sacramento, CA: Department of Health Care 

Services, 2011), 

http://www.dhcs.ca.gov/Documents/2_Arrowhead%20Regional%20Medical%20Center%20DSRIP.pdf. 

34 “State and County QuickFacts: Colton city, California” (see note 32). 

2. Incident Context and Background Information 15 
 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

A history of collaboration: Responding public safety agency descriptions 

The city of San Bernardino is challenged by high murder rates, violent crime, and drug and gang activity. 

It is a challenging place to be a police officer, but the department enjoys a good reputation and collaborates with its regional law enforcement partners regarding crime and quality-of-life issues. The following 

sections describe the public safety organizations who responded to the December 2 terrorist shooting at 

the IRC. 

State and local law enforcement organizations 

San Bernardino Police Department 

The San Bernardino Police Department (SBPD) serves the city of San Bernardino. In 2009, the police 

department had 350 officers, but as a result of filing for bankruptcy in 2012, that number dropped to 

220. Since 2012, gang activity has increased as has the city’s homicide rate.

35 According to the 2015/16 

City of San Bernardino Budget, the department is authorized for 248 sworn and 173 civilian staff;

36 

however, the actual numbers of sworn and civilian staff are 220 and 145 respectively.37 The SBPD’s 

Uniformed Patrol Division and community service officers respond to approximately 1,000 calls for service every 24 hours. The Patrol Division also includes the K-9, Traffic, and Bicycle Enforcement Units. 

The SBPD’s Investigations Division includes the Detective Bureau—Specialized Crimes, Property Crimes, 

Robbery, and Homicide and the Special Enforcement Bureau—Vice, Narcotics, Gangs Unit, Multiple 

Enforcement Teams, Hostage Negotiations Team, and special weapons and tactics (SWAT). The SBPD’s 

Administrative Services Division provides support services, maintains all of the automation and communications equipment, and includes the Training Unit and the City’s Public Safety Answering Point.

38 

The December 2 terrorist shooting at the IRC and the final shootout between the terrorists and law 

enforcement occurred within the SBPD’s jurisdiction. SBPD officers were first on scene, and the department in conjunction with the San Bernardino County Sheriff’s Department and the Federal Bureau of 

Investigation (FBI) maintained primary incident command. Its officers were initially responsible for the 

investigation of the shooting incident and also responded to the gun battle with the suspects. 

35 James Barragan, “San Bernardino’s Rising Homicide Rate Troubles Cops, Residents,” Los Angeles Times, July 29, 

2014, http://www.latimes.com/local/lanow/la-me-ln-san-bernardino-homicides-20140729-story.html. 

36 Fiscal Year 2015–16 Adopted Operating and Capital Improvement Program Budget (San Bernardino, CA: City of 

San Bernardino, 2015), 98, https://www.ci.san-bernardino.ca.us/civicax/filebank/blobdload.aspx?blobid=19343. 

37 Jarrod Burguan, Chief, San Bernardino Police Department, in e-mail to Jennifer Zeunik, Director of Programs, 

Police Foundation, July 21, 2016. 

38 “The Divisions,” City of San Bernardino, accessed April 11, 2016, https://www.ci.sanbernardino.ca.us/cityhall/police_department/about_sbpd/the_divisions/default.asp. 

16 Bringing Calm to Chaos: The San Bernardino Public Safety Response 
 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

San Bernardino County Sheriff’s Department 

Formed in 1853, the San Bernardino County Sheriff’s Department (SBCSD) serves 14 of the county’s 24 

cities with 3,571 total employees.39 One of the SBCSD’s 17 divisions, the Specialized Enforcement Division, has a Crime Impact Team that is responsible for gathering intelligence, conducting investigations 

into violent crime offenders, and SWAT. Within the Specialized Enforcement Division, a majority of 

deputies are trained as SWAT operators in addition to other duties, and some team members are crosssworn as U.S. marshals.40 Team members investigate serious crimes that occur in the county as requested by stations and divisions. They work closely with federal agents and are cross-designated as deputy 

U.S. marshals to apprehend fugitives across the country. The SBCSD’s Specialized Enforcement Division 

also includes an Arson/Bomb Detail that investigates all suspicious fires within the SBCSD’s jurisdiction. 

Accredited by the FBI in handling explosive devices, the detail maintains one of the largest police bomb 

ranges on the west coast and is used by local bomb squads and others throughout southern California 

for training and the destruction of confiscated explosives. The Specialized Enforcement Division comprises five fugitive apprehension teams and includes a Regional Gang Unit and the San Bernardino County Movement Against Street Hoodlums (SMASH), which works to suppress criminal gang activity in the 

county. 

The SBCSD assisted the SBPD and the FBI with incident command during the response to the December 

2 terrorist shooting at the IRC. It also responded to and maintained responsibility for the scene of the 

gun battle that ultimately killed the suspects. 

California Highway Patrol 

Created in 1929, the California Highway Patrol (CHP) works to keep California roads and highways safe 

by providing uniform traffic law enforcement throughout the state.41 The CHP is the largest state police 

agency in the United States with 10,551 total law enforcement employees as of 2014. 

The CHP assisted at both the IRC and shootout scene with emergency response, scene management, 

and traffic control. 

39 2015 Annual Report (San Bernardino, CA: San Bernardino County Sheriff’s Department, 2015), 

http://cms.sbcounty.gov/Portals/34/AnnualReports/Sheriff_2015_AR.pdf?ver=2016-03-18-145858-567, 10. 

40 “Specialized Enforcement,” San Bernardino County Sheriff’s Department, accessed April 11, 2016, 

http://cms.sbcounty.gov/sheriff/Divisions/SpecializedEnforcement.aspx. 

41 “About Us,” California Highway Patrol, accessed April 12, 2016, https://www.chp.ca.gov/Home/About-Us. 

2. Incident Context and Background Information 17 
 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

Colton Police Department 

The Colton Police Department is a municipal police agency within San Bernardino County that is 

staffed with 51 sworn officers and 32 civilian employees. The Colton Police Department has two divisions: an Administration Division, which includes the Office of the Chief of Police and the Code Enforcement Department, and an Operations Division, which includes citizen volunteers, detectives, honor 

guard, K-9, and traffic.42 

The Colton Police Department is part of the Inland Valley Regional SWAT team that responded to both 

the initial terrorist attack at the IRC and the final shootout with the suspects. 

Fontana Police Department 

The Fontana Police Department, founded in 1952, currently has 188 sworn officers who serve in three 

divisions: Administrative Services, Field Services, and Special Operations.43 

The Fontana Police Department arrived shortly after the first four officers entered the IRC. The second 

team to enter the IRC included three Fontana detectives, one of whom was a SWAT team member. The 

Fontana Police Department is also a member of the Inland Valley Regional SWAT team. 

Inland Valley Regional SWAT 

In 2012, the cities of Rialto, Colton, and Fontana—all found in San Bernardino County—joined forces to 

create the Inland Valley SWAT (IVS) team, a 45-person tactical and negotiating team highly trained in 

specialized tactics and complex negotiations. Comprising five rotating teams, the IVS is able to respond 

to major incidents within the region in a minimal response time, assuring a prompt response during an 

emergency.44 

The IVS responded to both the initial shooting at the IRC and the final shootout with the suspects. 

42 “Divisions,” City of Colton Police Department, accessed June 21, 2016, http://www.coltonpd.org/31/Divisions. 

43 “About Us,” Fontana Police Department, accessed June 21, 2016, 

https://www.fontana.org/index.aspx?NID=2509. 

44 “Regional SWAT Team,” Rialto Police, accessed April 11, 2016, http://www.rialtopd.com/index.php/divisions1/operations-bureau/special-weapons-and-tactics-swat. 

18 Bringing Calm to Chaos: The San Bernardino Public Safety Response 
 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

Redlands Police Department 

The Redlands Police Department is a municipal police agency that serves and protects the City of Redlands. It has an Investigative Services Bureau, a Patrol Services Bureau, a Special Operations Bureau, and 

Support Services Bureau that allow the department to respond to incidents in the area.45 

The assailants’ home is in the jurisdiction of the Redlands Police Department. The department responded to assist with stopping the suspect and securing the suspects’ home. 

Rialto Police Department 

The Rialto Police Department is a municipal police agency within San Bernardino County. More than 140 

total employees, including 103 sworn officers, serve the city. In addition to being a part of the Inland 

Valley Regional SWAT team, the Rialto Police Department offers a variety of services and assignments 

including Patrol, K-9, School Resource Officer, Street Crime Attack Team, Investigations, Traffic, Narcotics, Training/Backgrounds, Community Services, and Re-Entry Support Team and is a part of a Regional 

Air Support Unit.46 

Fire and emergency response agencies 

Inland Counties Emergency Medical Agency 

The Inland Counties Emergency Medical Agency (ICEMA) is the local emergency medical services (EMS) 

agency for Inyo, Mono, and San Bernardino counties. The ICEMA works to maintain a system of quality 

patient care and coordinated emergency medical response system in the area with fire departments and 

public ambulances and with prehospital providers and hospitals, including specialty care hospitals such 

as trauma and cardiac care hospitals.47 

45 “Redlands Police Department,” Redlands Police Department, accessed April 11, 2016, 

http://cityofredlands.org/police. 

46 “Department History,” Rialto Police Department, accessed June 23, 2016, 

http://www.rialtopd.com/index.php/more/department-history. 

47 “Home,” Inland Counties Emergency Medical Agency, accessed April 11, 2016, 

http://www.sbcounty.gov/icema/main/Default.aspx. 

2. Incident Context and Background Information 19 
 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

Ontario Fire Department Explosive Ordinance Disposal 

Serving the city of Ontario in southwestern San Bernardino County, the Ontario Fire Department 

responds to more than 15,000 calls per year. The department comprises eight stations, with eight fourperson paramedic engine companies and two four-person truck companies.48 The department has a 

Hazardous Materials Team, a SWAT paramedic, and a Bomb Squad that responds to all incidents involving explosives and related matters in the cities of Ontario, Montclair, Upland, Chino, and Rancho 

Cucamonga.49 

Ontario Fire Department Explosive Ordinance Disposal responded to assist with potential explosive 

devices. 

San Bernardino City Fire Department / San Bernardino County Fire 

The San Bernardino City Fire Department (SBFD)50 has 134 employees comprising 102 safety employees and 32 nonsafety employees. These employees staff 10 fire engine companies, two aerial truck 

companies, one heavy rescue, five four-wheel-drive brush engines, one hazardous material response 

rig, and one medic squad housed in 10 stations in the city.51 In the calendar year 2008, the department 

responded to 28,171 life- and property-threatening emergency incidents and another 23,790 medical 

emergencies.52 

At 20,160 square miles, San Bernardino County is the largest county in the continental United States.53 

The San Bernardino County Fire Department’s (SBCFD) jurisdiction encompasses 16,535 square miles 

of extremely diverse environments that stretch from the Los Angeles County line on the west to the 

Colorado River on the east to the Nevada State line and Kern and Inyo counties on the north. The 

SBCFD provides services to more than 60 communities and cities and all unincorporated areas of the 

county. The SBCFD is staffed by 977 fire personnel with 639 assigned to fire suppression. The SBCFD 

maintains 56 active fire stations. In FY 2014–15, the SBCFD responded to 83,695 calls for service in these 

complex areas.54 

48 “Ontario Fire Department,” City of Ontario, accessed April 11, 2016, http://www.ontarioca.gov/fire. 

49 “Bomb Squad,” City of Ontario, accessed April 11, 2016, http://www.ontarioca.gov/fire/operations/bomb-squad. 

50 As of July 1, 2016, the San Bernardino City Fire Department merged with the San Bernardino County Fire District. 

51 San Bernardino Fire Department EMS Coordinator, in e-mail to COPS Office staff, June 29, 2016. 

52 “San Bernardino City Fire Department Statistics” (see note 9). 

53 Annual Report July 2014–June 2015 (San Bernardino, CA: San Bernardino County Fire Department, 2015), 5, 

http://cms.sbcounty.gov/Portals/58/Documents/About/2015AnnualReport.pdf. 

54 Ibid. 

20 Bringing Calm to Chaos: The San Bernardino Public Safety Response 
 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

The SBCFD Office of Emergency Services (OES) serves as the operational area lead agency, coordinating 

the provision of emergency services with the 24 cities and towns in San Bernardino County. The OES 

division has developed emergency plans and procedures that have also received national and state 

recognition.55 

The SBFD was the primary medical first responder to the shooting at the IRC. The department established the medical triage and treatment area and handled logistics for medical transport of victims. The 

SBCFD also provided substantial support during the incident. 

Other local responding agencies 

San Bernardino City Unified School District 

The San Bernardino City Unified School District (SBCUSD) had 53,365 students during the 2014–15 

school year. Of these students, 91.63 percent were in high poverty and 26.6 percent were English learners. Almost three-quarters (73 percent) of students were Hispanic, 14 percent were African American, 

and 8 percent were White alone. The 76 schools were served by 7,809 employees, including 49 elementary schools, 11 middle schools, 10 high schools, one adult education program, three special education 

programs, two alternative programs, and 12 charter schools.56 

The SBCUSD police patrol all sites in the district seven days a week and maintain a radio dispatch and 

an alarm-monitoring center that is in operation at all times. Concerned with protecting the safety 

of students, employees, and visitors and with preventing thefts and burglaries on school grounds, 

SBCUSD officers are prepared to handle nearly all emergencies or to notify proper responders for incidents beyond their scope.57 The SBCUSD police department has 30 police officers, 54 campus security 

officers, seven dispatchers, and a 24-vehicle fleet.58 

55 Ibid. 

56 “2015 District Overview,” San Bernardino City Unified School District, last modified September 2015, 

http://sbcusd.com/DocumentCenter/View/124280. 

57 “San Bernardino District Police Department,” San Bernardino City Unified School District, accessed April 11, 

2016, http://www.sbcusd.k12.ca.us/index.aspx?NID=432. 

58 “Logistics,” San Bernardino City Unified School District, accessed April 11, 2016, 

http://www.sbcusd.k12.ca.us/index.aspx?nid=568. 

2. Incident Context and Background Information 21 
 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

The SBCUSD responded to the December 2, 2015, terrorist incident scene with police officers as well as 

Office of Emergency Services personnel to assist with scene management and medical triage and security. In addition to providing first responders, the school district was significantly impacted in that it initiated a lockdown of all 80 schools and other buildings in an effort to secure all locations, personnel, and 

students in their care. This kept more than 50,000 students and 8,000 staff members and visitors from 

moving for a matter of hours. 

San Bernardino County District Attorney’s Office 

The San Bernardino County District Attorney’s Office was created by an act of the California State Legislature on February 27, 1853.59 The District Attorney’s Office represents the interests of the people of 

San Bernardino County in the criminal justice system, assists state and local law enforcement agencies in 

the investigation and prosecution of criminal cases, and provides assistance and aid to victims of 

crimes.60 

The San Bernardino County District Attorney’s Office sent representatives from its Bureau of Victim Services to provide a comprehensive list of services to victims and witnesses at both the Rock Church and 

the Rudy Hernandez Community Center. 

San Bernardino County Probation 

With more than 1,000 employees, the San Bernardino County Probation Department supervises and 

provides case management services for adult and juvenile offenders in the county, offers treatment 

programs to assist in rehabilitation, and serves as an investigative arm of the San Bernardino Superior 

Courts. The department also operates a Criminal Intelligence Unit, which analyzes crime trends and 

geographic and gang intelligence information and works with law enforcement agencies within San 

Bernardino County to ensure sharing of information and communication. In fiscal year 2013–2014, the 

department supervised more than 20,000 offenders.61 

Representatives of the San Bernardino County Probation Department were some of the first on scene 

and were responsible for setting up and managing the transportation and triage of victims. They also 

managed Hernandez Center operations as part of the investigation and witness interviews. 

59 “Office of the District Attorney,” San Bernardino County District Attorney, accessed June 21, 2016, 

http://www.sbcountyda.org/AboutDARamos/HistoryoftheOffice.aspx. 

60 “Office of the District Attorney,” San Bernardino County District Attorney, accessed June 21, 2016, 

http://www.sbcountyda.org/AboutDARamos/AbouttheOfficeoftheDistrictAttorney.aspx. 

61 “2013–2014 Annual Report,” San Bernardino County Probation Department, 2014, 

https://www.sbcounty.gov/Uploads/Probation/Main/annual_reports/2013_14_Annual_Report.pdf. 

22 Bringing Calm to Chaos: The San Bernardino Public Safety Response 
 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

Federal partners 

Federal Bureau of Investigation 

The FBI leads a number of Joint Terrorism Task Forces that bring together representatives of local, state, 

and federal agencies to pursue terrorism leads, develop and investigate cases, support special events, 

and identify threats that may impact the area and nation. A satellite of the FBI’s Los Angeles office, the 

Inland Empire Joint Terrorism Task Force, covers San Bernardino. This task force has full-time members 

from the Riverside County Sheriff’s Office, Riverside Police Department, San Bernardino County Sheriff’s 

Department, U.S. Immigration and Customs Enforcement’s Homeland Security Investigations unit, and 

the U.S. Attorney’s Office. Relationships are also maintained with all other departments in the area.62 

The FBI responded immediately to the scene and provided mutual aid and support at the incident command and tactical support through executive management personnel, SWAT agents, special agent bomb 

technicians, and investigators. In addition, FBI personnel conducted the evidence recovery efforts at the 

IRC and subject residences. The FBI became the lead investigative agency once the shooting at the IRC 

was determined to have been a terrorist event. 

Bureau of Alcohol, Tobacco, Firearms, and Explosives 

Part of the U.S. Department of Justice (DOJ), the Bureau of Alcohol, Tobacco, Firearms, and Explosives 

(ATF) works to protect communities from violent criminals, criminal organizations, the illegal use and 

trafficking of firearms, the illegal use and storage of explosives, acts of arson and bombings, acts of terrorism, and the illegal diversion of alcohol and tobacco products.63 In 2014, the ATF as a whole had 

4,803 employees, including 2,490 domestic and foreign special agents and 780 industry operations 

investigators.64 The ATF conducted 26,165 investigations in FY 2014.65 

The ATF was responsible for assisting in the investigating the source of the firearms seized from the suspects as well as recovered explosive devices. 

62 Paul Larocco, “San Bernardino Cops No Longer on Terror Task Force Full Time,” Newsday, December 4, 2015, 

http://www.newsday.com/news/nation/san-bernardino-cops-no-longer-on-terror-task-force-full-time1.11194633. 

63 “About,” Bureau of Alcohol, Tobacco, Firearms, and Explosives, accessed April 11, 2016, 

https://www.atf.gov/about. 

64 “Fact Sheet: Staffing and Budget,” Bureau of Alcohol, Tobacco, Firearms, and Explosives, accessed April 11, 2016, 

https://www.atf.gov/resource-center/pr/staffing-and-budget. 

65 “ATF Crime and Punishment,” Bureau of Alcohol, Tobacco, Firearms, and Explosives, accessed April 11, 2016, 

https://www.atf.gov/file/atfcrimeandpunishmentjpeg. 

2. Incident Context and Background Information 23 
 

 

 

 

 

 

 

Department of Homeland Security / Homeland Security Investigations 

Homeland Security Investigations (HSI) is an investigative arm of the U.S. Department of Homeland 

Security (DHS) that looks into all types of cross-border criminal activity, including terrorism and immigration, as well as document and benefit fraud. The HSI has 26 field offices across the United States, including in Los Angeles.66 

DHS/HSI was on scene as part of the federal response to the terrorist shootings. 

66 “Homeland Security Investigations,” U.S. Immigrations and Customs Enforcement, accessed April 12, 2016, 

https://www.ice.gov/hsi. 

24 Bringing Calm to Chaos: The San Bernardino Public Safety Response 
 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

Section II. Incident Description 

3. Police Response to Terrorist Shooting 

at Inland Regional Center 

On December 2, 2015, at 10:59 a.m., the Inland Regional Center (IRC) in San Bernardino, California, 

came under attack. The incident began as what is now known to be two shooters, dressed in all black, 

entered the IRC and began shooting. Before it was over, 36 innocent people had been shot: 22 injured 

and 14 killed. It was later determined that one of the shooters was a coworker of many of the victims. 

The other shooter was his wife. Authorities determined this was a premeditated, planned terror attack. 

San Bernardino first responders were on the scene in less than four minutes. The San Bernardino Police 

Department (SBPD) special weapons and tactics (SWAT) team was on the scene within 11 minutes. This 

report is an account of the events of that day. 

A normal start to a traumatic day 

Approximately 80 staff members of the San Bernardino County Environmental Health Department 

gathered for a day of training at the IRC. The IRC is a frequent training location for county departments 

because of the conference room’s large size and its close proximity to the county office building. Ironically, the Environmental Health Department had met a year earlier in this same room to conduct active 

shooter training. 

IRC staff filled the room with Christmas décor, not specifically for this training but for a holiday party 

and other holiday events to be held later in the room.

67 A large green Christmas tree with decorations 

stood in the corner and ornaments and other accessories hung on the walls and from the ceiling. Several 

rows of tables and chairs filled the majority of the room, with a horseshoe-shaped row at one end for 

department leaders and a table covered with food and snacks at the other end. 

The group settled in for the meeting that began around 8:00 a.m. They watched a training video and 

then moved on to a team-building exercise as a way for staff members to get to know one another better. The plan was to have more technical training in smaller groups later in the day. 

67 Many media outlets reported that employees were gathering for a holiday party. Rooms in the IRC were 

decorated for the holidays, and the employees were both attending training and holding a holiday party. 

25 
 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

Around 10:30 a.m., one of the employees, Rizwan Farook, an environmental health inspector, got up 

from his chair and left the meeting. Colleagues noticed him looking at his phone before he departed, 

but no one thought much of it. He had left his bag on the table, and they expected he would be back to 

retrieve it. 

Farook’s coworkers remembered that he was pleasant. However, some believed his demeanor changed 

and he became more stoic after he made a trip to the Middle East and returned with a wife. His coworkers had held a baby shower for his family a few months before the incident. 

Shortly before 11:00 a.m. that day, the group took an unscheduled break because of a technical 

problem. Some headed to the restrooms and others to the food table, while others remained seated, 

checking their phones or talking with colleagues. Out of the blue, multiple popping sounds crackled 

outside. Several of the county workers thought fireworks had been lit, but others recognized the sound 

as gunfire. 

Suddenly, a door swung open and a person clad in all black, with a mask shielding his or her face, 

stepped inside, wielding what appeared to be an automatic rifle. Without saying a word, the person, 

now believed to be Rizwan Farook (the male assailant), opened fire. 

A handful of workers sprinted for a door on the far side of where the shooter stood that led into the 

complex. Someone screamed “get down” as some took cover under tables. Others just stood there, 

either incredulous at what was happening or believing it was an active shooting drill. Some victims and 

witnesses who had previoulsy received active shooter training—some in that very room—reported that 

they initially thought the shooting was part of another training exercise. However, once they realized it 

was a real shooting incident, they reacted according to what they had been trained to do and exited 

through the doors. 

A second shooter followed the first. Witnesses could not tell at the time, but the shooter was the 

male assailant’s wife, Tashfeen Malik (the female assailant), although some witnesses subsequently told 

investigators that they thought the second shooter was a woman because of her slight build and tightfitting clothes. She also wore all black and entered the room shooting. Together, the shooters fired more 

than 100 rounds. 

As the chaos unfolded, a round hit a fire sprinkler pipe causing water to pour out of the ceiling. The 

water and smoke that filled the room made it difficult for people to see. The shooters walked between 

tables. If someone moved or made a sound, the shooters fired one or multiple shots into their body. 

Many of the conference room’s occupants made it out the door that led to the rest of the building. 

Some continued until they were outside; others headed for other rooms that they could lock; and still 

more searched for a place to hide, choosing closets, cabinets, or bathrooms to take shelter. 

26 Bringing Calm to Chaos: The San Bernardino Public Safety Response 
 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

Bullets tore holes through the interior wall of the conference room. At least one woman was struck by a 

bullet that had ripped through a wall, and another was shot as she tried to escape through a glass door 

near where the shooters had entered. Others who ran outside came across the bodies of the first two 

people killed by the shooters. They had been outside when the shooters arrived, and both appeared to 

have been killed instantly. 

Some two or three minutes after they first entered the conference room and fired more than 100 

.223-caliber rounds, the shooters stopped and hastily departed, heading out to a black SUV they had 

parked just outside, leaving behind a chaotic scene of noise, fear, and pain. 

The first to respond 

The initial response to the attack was not handled by SWAT team members or other tactically trained 

law enforcement units. The first responders were typical police officers, some late in their careers, others just beginning, but collectively the sort that are the face of every police department. They are the 

men and women who are on the front lines every day in cities and towns across the United States. 

The first four police officers to arrive were an administrative lieutenant, a motor officer, a patrol officer, and a detective from the SBPD. (Shortly thereafter, detectives from the Fontana Police Department arrived.) The lieutenant had just grabbed lunch and was headed to fill up his cruiser’s gas tank. The 

patrol officer was driving the streets of the city of San Bernardino with a community service officer at 

the wheel. The homicide detective filling in on patrol had stopped at headquarters to use the bathroom. 

And the fourth was a motor officer, who had just picked up a sandwich. “If you were picking a team, the 

four of us were not the ones that would be picked first, but we have all had active shooting training,” 

said the lieutenant who led the initial charge into the building. “It just seemed like we knew what our 

roles were and what we were supposed to do.” The officers had learned during active shooter training 

to form a three- to four-officer contact team and immediately attempt to capture or neutralize the 

shooter(s). 

The lieutenant reported that a few minutes prior to 11:00 a.m., he left a restaurant and was heading to 

gas up his police vehicle when he got a cell phone call. He pulled over to take it and simultaneously 

heard a female dispatcher report a call: 

“Shots heard in the area.” 

According to the lieutenant, you hear that sort of call frequently in San Bernardino. He also noted that 

the dispatcher’s voice was calm. The lieutenant decided to respond to the call despite his administrative 

assignment. 

Back in dispatch, a third caller had made it clear not only that this was real but also that there were 

multiple shooters and they were still there. The threat of active shooters was then relayed across 

the radio, just as the lieutenant pulled up to the IRC, which is a large compound with three interconnected buildings. 

3. Police Response to Terrorist Shooting at Inland Regional Center 27 
 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

The lieutenant pulled up to the south side of the building. He did not know where the incident was 

unfolding, but by pure luck he had picked the closest point to it. “I was getting out of my car and took 

position to the south of my vehicle. That’s when I said [over the radio], ‘Give me three more [officers] so 

we can go in.” He advised dispatch that the next team should go in on the north side. “I wanted us to 

push from the south and them from the north, which may not have been smart because of crossfire, but 

we needed to contain them.” 

A patrol officer joined him soon after. He had been on the passenger side of a cruiser with an unarmed 

community service officer, but upon receiving the call had instantly ordered the community service 

officer to switch seats and give him the wheel. Upon arriving at the IRC, he told the community service 

officer to move away from the buildings and seek cover. The patrol officer grabbed his ballistic helmet 

and shotgun and headed into the building. 

Slightly more than three miles away, the homicide detective filling in on patrol had just finished a brief 

break when he heard the call. He raced to his cruiser and headed “Code 3” (i.e., with lights and sirens) to 

the IRC. As he was driving, he thought about the shooter he might be about to confront, and then he 

cursed at himself for leaving without his “go bag” filled with a helmet and other equipment and for not 

having brought a patrol rifle. 

At the same time, a motor officer who had just bought a sandwich leapt onto his motorcycle and rushed 

to the general area of the IRC. He had not heard the exact address but thought he would find his colleagues, either by seeing their cars or looking for the San Bernardino County Sheriff’s Department’s 

(SBCSD) helicopter, known as 40 King. 

The four SBPD officers gathered outside of the IRC, a three-story compound that is home to a private 

nonprofit community-based agency providing services to people with disabilities. The lieutenant 

explained they would use the diamond formation that they had learned during active shooter training, 

and he reminded them to stay particularly vigilant for secondary devices. “As they were walking up [to 

the building], one of them said: ‘Okay, it’s time to go.’” 

“Shots heard in the area.” 

“I felt so naked, because we didn’t have cover and concealment approaching the building,” the patrol 

officer said. “You know you are outgunned, it is going to be hard to beat an AR with a handgun, so I 

knew we needed good shot placement.” 

28 Bringing Calm to Chaos: The San Bernardino Public Safety Response 
 

 

 

 

 

The AR-15 

The Colt ArmaLite Rifle 15, more widely known as the AR-15, is the civilian version of 

the Military’s M-16 rifle originally designed by ArmaLite. This rifle is semiautomatic 

(one shot for each pull of the trigger) and uses a detachable box magazine to hold 

multiple cartridges. It was originally designed for the 5.56x45mm NATO cartridge; 

however, the AR-15 is now available in many different calibers and produced by many 

different manufacturers. 

The A R-15 rifles (top) and handguns (bottom) used in the attack 

Photo: San Bernardino County Sheriff’s Department 

The AR-15 is a popular lightweight, small caliber, accurate semiautomatic rifle that is 

popular amongst target shooters in competitions and small-game hunters because of 

its easily customizable features. It has been used in a number of active shooter and 

other hostile events. 

Source: Erica Goode, “Rifle Used in Killings, America’s Most Popular, Highlights Regulation

Debate,” New York Times, December 16, 2012, http://www.nytimes.com/2012/12/17/us/lanzaused-a -popular -a r -1 5- style- rifle-i n-newtown.html. 

Rounding the southeast corner of the building, the team of four encountered three deceased victims. 

The first was a woman lying on the ground outside of the double glass doors, which had been shot out. 

The second was a man sitting on a bench. His cell phone was still in his hand, and at first the officers 

thought he was alive until they saw the extent of his wounds. Finally the team saw a man who appeared 

to have been eating his lunch sitting at a picnic table. 

3. Police Response to Terrorist Shooting at Inland Regional Center 29 
 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

The officers looked inside. It was dark, and smoke from gunfire still could be seen and smelled. A fire 

alarm wailed in the background, and scared, anguished voices could be heard calling for help as others 

moaned uncontrollably. 

“We have all seen people that have been shot before, but those rounds were devastating to people,” 

the patrol officer said. “These were good people, dressed up, just trying to do their job.” 

Pandemonium 

The four officers stared into the conference room. It looked like a bomb had gone off. Bodies were 

strewn across the floor. Many had devastating wounds. Blood was everywhere. The smell of gunpowder 

filled their nostrils, and the sprinklers sounded like they were hissing. 

The team moved through the room in their diamond formation and worked their way to the other 

side. Wounded victims pleaded with them to stop, taking hold of the officers’ legs in hopes of receiving 

aid. One of the officers recalled being told at active shooter training to expect that, and despite the difficulty of doing so, the team moved forward as they had been trained. Ever since the killings at Columbine 

High School in Colorado in 1999, officers have been trained to form up and enter buildings where they 

believed the active shooter or shooters to be and engage them as quickly as possible to prevent them 

from killing more people.68 

“It was the worst thing imaginable—some people were quiet, hiding, others were screaming or dying, 

grabbing at your legs because they wanted us to get them out, but our job at the moment was to keep 

going,” the patrol officer said. “That was the hardest part, stepping over them.” 

The first contact team moved deeper into the building, encountering people who were hiding under 

tables and in the hallways. The officers told the people to move out toward them, but some were reluctant to do so because they were unsure of whether they were “real” police officers. The first contact 

team eventually met up with a second team of officers who had come in from the north side of the 

building. Like the initial contact team, these officers were not an organized SWAT unit, although one 

was a SWAT team member. The second team comprised a San Bernardino patrol officer and three Fontana Police Department detectives (one of whom was the SWAT team member) who had been in San 

Bernardino on an investigation. They had quickly devised a plan and entered the building. The two 

teams began clearing first floor rooms and bathrooms. 

68 “The critical nature of: Locate – Isolate – Evacuate, is that these steps must be followed in this priority order. If 

we begin to evacuate people who may be wounded or in the line of fire before we have located the suspect and 

isolated him, we allow ourselves to become targets, and the suspect to move about possibly harming more 

people.” John Kane, The Critical Incident Response Manual for Supervisors and Managers (Sacramento, CA: D-PREP, 

LLC, 2004), 27. 

30 Bringing Calm to Chaos: The San Bernardino Public Safety Response 
 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

The teams worked together well given the circumstances. “There really wasn’t anyone saying, ‘Hey, I am 

a lieutenant,’ or ‘I am a captain, I want to be in charge,’” the patrol officer said. “Everyone wanted to get 

things done. Rank did not matter.” 

Agency leaders arrive and take charge 

At the time of the attack, San Bernardino Police Chief Jarrod Burguan was attending a regularly scheduled meeting of city department heads. His cell phone, which was on vibrate, kept going off. One of his 

captains was calling to advise him that they had an active shooter incident. Burguan got up and immediately headed to the scene. 

“It was complete and total chaos when I got there,” the chief recalled. “There were already a lot of 

emergency vehicles there. Initially, you are just trying to get a handle on what is going on because the 

[police] radio is overwhelmed.” 

Having so many emergency vehicles eventually would create problems. Vehicles were parked randomly 

as officers sprinted to the IRC while fire engines and ambulances staged as close as possible. As the incident continued to unfold, this disorganization became more and more problematic as entry and exit 

lanes were blocked. 

Chief Burguan received a call from San Bernardino County Sheriff John McMahon, who had been at a 

meeting about 45 minutes away. McMahon offered any help his department could provide. “Whatever 

you need,” McMahon said several times. 

At the time of the incident, Sheriff McMahon had been in office for three years. Shortly after taking 

office in 2013, he had led the search for former Los Angeles police officer Christopher Dorner, and he 

brought valuable experience to the police response to the terrorist attack. 

As Sheriff McMahon drove back from his meeting, he got a call from David Bowdich, who was the FBI’s 

Assistant Director in charge of the Los Angeles Field Office. Bowdich informed McMahon that he was on 

his way and ready to provide assistance. 

When the shooting occurred, Assistant Director Bowdich was interviewing candidates to fill a special 

agent in charge vacancy in the Los Angeles Field Office. His secretary interrupted him and informed him 

of a possible active shooter in San Bernardino. He had a member of his crisis team make some calls, and 

once it was determined to be a real event he ended the interview and headed to the scene. It is normally about an hour and 45-minute drive from the Los Angeles Field Office to San Bernardino. Fortunately, 

agents from the FBI's Riverside Office were able to respond to the Incident Command location within 

about 30 minutes. “To be quite frank, [scenes like this] are chaotic, you have more people than assignments,” Bowdich said. “You never lack for people, you just need to figure out what to do with them all.” 

3. Police Response to Terrorist Shooting at Inland Regional Center 31 
 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

“There really wasn’t anyone saying, . . . ‘I want to be in 

charge.’ . . . Rank did not matter.” 

An army of probation officers 

One of the critical aspects of the law enforcement response to the shooting at the IRC was that the 

building is in the heart of the city, and multiple agencies were headquartered close by. The SBCSD’s 

headquarters is 1.9 miles away. The SBPD is 3.5 miles from the site. And equally important, the San Bernardino County Probation Department is between both, just 2.9 miles away. 

County probation officers were familiar with the IRC, as they had held a graduation ceremony there a 

week earlier. The probation officers were accustomed to working closely with other law enforcement 

agencies in the performance of their duties as well as in supporting the other agencies’ activities. 

A probation department sergeant heard the call over the police radio, grabbed another probation 

officer, and raced to the IRC, making it in less than three minutes. As they pulled into the back parking 

lot, they could see people hiding behind cars and trees. Another group had taken shelter behind an 

electrical box and some were asking for medical attention. The two probation officers ran to the group 

behind the electrical box, gave a first aid kit to someone in the group, and moved toward the building. 

Although prepared to enter, they did not because of the number of injured people they encountered. 

“Everybody was frantic,” the sergeant said. “The terror in their eyes was unbelievable. It was scarier 

than the wounds.” 

The sergeant called probation’s dispatch and asked for help. Within minutes, dozens of probation 

officers arrived on the scene. Leaders at the command post eventually used the huge team of probation 

officers to secure the building and triage area perimeters. 

Training for the real thing 

When the first calls for help came in to the dispatch center, the SBPD’s SWAT team was training at the 

Arrowhead Springs Hotel. The hotel sits along the southern side of the San Bernardino mountains just 

north of the city. 

Coincidentally, the SWAT team was conducting active shooter drills inside the hotel. A dozen members 

of the team had just finished a drill and were about to take a break when they heard the active shooter 

call over the radio. 

32 Bringing Calm to Chaos: The San Bernardino Public Safety Response 
 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

Nine minutes later, the first SBPD SWAT team members arrived at the IRC after making the 11.7-mile 

drive. They geared up as their lieutenant assessed the scene. As he looked around, he could see cops, 

sheriff’s deputies, and what seemed like dozens of probation officers all doing something but not necessarily working cohesively. Some were beginning to figure out what to do with the wounded, others kept 

disappearing in and out of the IRC, while others stood sentry, their weapons trained at the second and 

third floors where they believed the shooters were hiding. “The initial problem was you had a ton 

of units coming from every agency, all these different uniforms, and everyone was running into the 

building, so we needed to coordinate some of these assets as they were coming in,” the SWAT 

lieutenant said. 

After a quick briefing, which included another reminder to look for secondary devices, additional teams 

formed up and entered the building. They passed through the conference room where other officers 

and a SWAT medic had begun triaging the victims. They met up with the two teams who had cleared 

some of the first floor. One SWAT officer remarked, “I came to a patrol officer who said, ‘All these doors 

are locked.’ I told him to just keep a gun on them.” 

Clearing the building 

An officer radioed for breaching tools. They also asked for electronic access cards, which IRC employees 

had. Those would prove useful in opening many of the locked doors throughout the IRC complex. 

As they worked through the second floor, they met up with members of the Inland Valley SWAT (IVS) 

team who had just arrived to help. The two SWAT teams had trained together and quickly developed a 

strategy to clear the second and third floors. 

It was physically exhausting because of the large number of locked doors that had to be forced open 

and the number of rooms that had to be searched. Their physical fatigue was exacerbated by the 

fact that they were wearing all of their gear, with ceramic plates in their vests, and working on an 

unseasonably warm winter day whose temperature reached the high 70s. The search process was also 

mentally demanding and required firearms discipline as the officers encountered frightened people clustered together, hiding and at times running toward the officers. As the officers and deputies escorted 

people out of one of the IRC buildings, one sheriff’s deputy told them not to worry: “I’ll take a bullet 

before you do.” 

It was difficult to keep track of the rooms that had been cleared because there was no standard marking 

system in use by the various tactical teams. “People were walking around on the second floor and I 

would say, ‘That door hasn’t been cleared,’” an officer said. “They would say, ‘Yes it has,’ but none of us 

really knew.” 

3. Police Response to Terrorist Shooting at Inland Regional Center 33 
 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

When the teams came to the last two rooms in the building they expected to find the shooters inside. 

“This is where, I don’t want to say I made peace, but I was ready to go,” said an IVS officer. “We got into 

one room, and it was empty. We had a quick breath, and in we went to the last room. I was never so 

excited to not see anybody.” Another colleague remarked, “We were pissed, where were they at?” he 

said. “We were pissed for the victims. Somebody had to stop this.” In reality, that wouldn’t happen for a 

few more hours. 

“The terror in their eyes . . . was scarier than the wounds.” 

Getting victims safely to triage 

As officers searched for the two shooters, others from multiple agencies were helping the wounded. At 

first, probation officers set up a triage area close to the entrance to the building in which the conference 

room was located. It was deemed too close to the building and was relocated with the help of San Bernardino firefighters across the street to the west near the entrance of the San Bernardino Golf Club. 

Probation and other officers carried out the wounded. It was hard work. Victims’ bodies were 

soaked from water pouring from the broken sprinkler pipe, making them slippery to hold. No one had 

litters69 or tactical stretchers in the beginning, so alternatives were found. Wounded people were carried out by hand, with blankets, and even on chairs. 

A San Bernardino County supervising probation officer found a woman hiding between two cars. The 

officer recalled seeing that she had a large hole in her leg and a smaller wound in her arm. “She starts 

talking to me, she is catatonic, but matter-of-fact, and she says, ‘I am going to die, please don’t let me 

die,’” the officer recalled, adding that she went on to tell him that she had been shot in the leg and the 

arm. “I look at her and say, ‘You’re not going to die, you’re going to be okay.’ Then I looked at [a colleague] and told him to get the car to transport her to triage.” In fact, the woman did not die, thanks to 

the probation officers getting her into a car and transporting her to the triage across the street. 

Several other officers with multiple agencies followed suit, carrying survivors to vehicles for transport. It 

turned into a conveyer belt-like system, with vehicles pulling up, getting filled with victims and then taking off. Altogether 24 people were triaged, two of whom later died. 

69 A litter is the official name for bowl-like stretchers that can be used to carry people or are used in search and 

rescue missions. 

34 Bringing Calm to Chaos: The San Bernardino Public Safety Response 
 

 

 

 

 

 

 

 

 

Officers knew which patients to take first because an SBPD tactical medic triaged the injured inside the 

conference room. He couldn’t use the traditional paper triage tags because of the water pouring from 

the ceiling. Instead, he used tape and wrote each patient’s status there. “Everybody worked together, 

and those people are alive because of it,” the tactical medic said. “That’s why so many people are still 

alive. We couldn’t have done it without the police department, fire department. Everyone.” 

Figure 2 shows the Inland Regional Center complex and the locations of relevant buildings, entry points, 

and other important locations. 

Figure 2. Inland Regional Center complex 

“We couldn’t have done it without the police department, 

fire department. Everyone.” 

3. Police Response to Terrorist Shooting at Inland Regional Center 35 
 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

Triage and transport: The golden hour rings true 

At the triage area, firefighters and paramedics treated the victims, binding wounds and doing whatever 

they could to assist the injured. Tarps were put out, designating the different levels of trauma. One other tarp had to be set up for two victims who died either en route or at the triage. 

Ambulances continued to arrive to take the wounded to local hospitals. Medical transport helicopters 

also landed on the golf course and transported a couple of the victims. Altogether, it took 57 minutes to 

get 22 wounded survivors, some critical, out of the IRC and to a hospital. In the medical community, it is 

believed that if injured or wounded people can be transported to a hospital in less than an hour—known 

as the golden hour—their likelihood of survival improves significantly.70 In this case and on that day, 

every victim taken to a hospital survived. 

At the same time, authorities led uninjured county employees and IRC staff to a nearby spot on the golf 

course and told them to stay there. Hundreds of people waited, sharing grief and tears and wondering 

what had just erupted in their world. 

Despite the fact that transportation arrangements were made as soon as possible, the wait turned into 

three hours as authorities worked to clear the buildings. There were no bathrooms and little shade, 

and cell phone batteries were dead or dying, leading to a growing angst and frustration from many. But 

authorities needed people to stay as they all had been witnesses in one way or another and needed to 

be interviewed. 

70 Charlie Eisele, “The Golden Hour,” Journal of Emergency Medical Services, August 31, 2008, 

http://www.jems.com/articles/2008/08/golden-hour.html. 

Discovery of secondary devices 

As the SWAT teams continued to work their way back through the buildings, they encountered a new 

development, the sort of thing they had been warning each other about: secondary devices. 

By this time, FBI SWAT agents had arrived on scene and were assisting officers combing through the 

crime scene inside looking for threats and explosive devices. At 5:08 p.m. as they worked in the conference room, one officer identified a suspicious bag and cleared the room. Shortly afterward, everyone 

was evacuated from the buildings and forced to move a safe distance away. The sheriff’s bomb squad 

was called in, and officers began the arduous process of removing what turned out to be secondary 

explosive devices left in the bag by Farook when he left the meeting. 

Investigators believed the secondary devices may have been left in the conference room to be detonated when the first responders were giving aid to the wounded or conducting the crime scene investigation. It is a frequent practice used in terrorist incidents. Bomb squad officers detonated the three pipe 

36 Bringing Calm to Chaos: The San Bernardino Public Safety Response 
 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

bombs individually, the last one taking place at 8:37 p.m. on the evening of December 2. The SBCSD 

bomb squad cleared the building a short time later. Once the building had been declared “tactically 

clear” it was handed back over to the SBPD. 

A lead surfaces 

During one interview conducted by a rookie SBPD officer, a county employee advised he had been 

watching one of his colleagues that morning. The employee noticed the colleague arrive and then leave 

early. A half hour later, when the shooting started, there was just something about the shooter, from his 

body language to his body composition, that seemed familiar. The employee advised that his name was 

Rizwan Farook. 

Armed with a name, the rookie officer contacted his father, who was a sergeant in the SBPD’s narcotics 

unit. The name was quickly searched by both SBPD and SBCSD crime analysts, and a handful of persons 

with the same name turned up in neighboring communities, including Redlands, which shares an eastern 

border with San Bernardino. Officers were dispatched to all of the known addresses, some as far away 

as Temecula, about 45 minutes to the south. 

Authorities then released to the public some information about the vehicle that witnesses had seen 

leaving the IRC parking lot. Several people called in reports, including one of a black SUV with Utah 

license plates. Police responded to each of the calls. 

Back at SBPD headquarters, an analyst kept digging. She ran a plate number memorized by a caller who 

reported a suspicious black SUV. It was registered to a rental car company. She contacted the rental 

car company and asked about the name Rizwan Farook. An individual at the rental car agency provided 

information that led to the critical match being made. 

SBPD sent an unmarked car to the Redlands address based on the information provided. There was 

no activity at the residence, but during interviews with neighbors following the incident, concerns 

were expressed over the number of people coming and going, along with late-night work in the home’s 

garage. 

Unbeknownst to just about everyone at the command post or the Redlands Police Department, several 

members of the SBPD’s narcotics unit had also headed to the Redlands house. They were using the 

push-to-talk feature on their phones to communicate with one another, intentionally keeping themselves off the radio. Narcotics officers were concerned that anyone could listen in to radio transmissions—at least, those that are not encrypted systems—via a smart phone application. “The media was 

able to scan our radio,” explained a narcotics sergeant. “I did not personally feel comfortable using our 

unit radios in case they were listening or if the shooters were listening to a scanner app.” 

3. Police Response to Terrorist Shooting at Inland Regional Center 37 
 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

The narcotics team had been 20 miles to the west conducting a surveillance operation when the 

first report of an active shooter hit the airwaves. After arriving at the IRC and seeing how hectic things 

were, the team headed to a nearby hotel and waited in the parking lot while the analyst was doing her 

research. Once the Redlands address was discovered, the team headed there. 

Just as the officers arrived at the home, they saw the SUV leaving. The narcotics officers followed behind 

in their unmarked cars as the SUV traveled through Redlands before eventually heading toward the 

freeway back to San Bernardino. 

The gunfight 

A Redlands patrol sergeant was monitoring a pursuit of a stolen car on the west side of his city when he 

was flagged down by members of the SBPD narcotics team that had located the IRC suspects’ SUV. Simultaneously, Redlands dispatch was broadcasting the same information to Redlands patrol units. 

The Redlands sergeant updated dispatch as he and another Redlands patrol officer responded “Code 3” 

on Interstate 10 trying to locate the narcotics team that was following the suspects. The SUV had exited 

at Tippecanoe Avenue in San Bernardino, which is quite close to the IRC, as a SBCSD deputy joined in 

behind the Redlands police cruiser. 

As the sergeant exited the interstate, he was slowed behind traffic waiting for a stop light to turn green. 

Narcotics officers who had been following the suspects stepped out and waved at the sergeant, pointing 

to the SUV that was three or four cars in front of him. 

The sergeant drove his vehicle around a raised center median and into oncoming traffic to get in position behind the suspect vehicle and initiate a traffic stop. His continuous activation of emergency lights 

and siren, by all accounts, alerted the suspects to the police presence. 

Knowing there were several undercover police officers as well as uniformed officers following in marked 

cars, the sergeant felt comfortable trying to make a stop. The SUV failed to yield. He could see it looked 

like its driver and passenger were putting on some sort of vests, and he put that information out over 

the radio. 

The suspects turned east on San Bernardino Avenue and headed a short way down the street. The 

back window shattered from within, as gunfire erupted from what is now known to be .223 rounds 

fired by the female assailant who was in the back seat. The male subject was driving the vehicle. The San 

Bernardino County Sheriff’s deputy came up at the same time, traveling parallel to the Redlands Police 

Department sergeant. Law enforcement officers from all three responding agencies—SBCSD, SBPD, and 

Redlands Police Department—broadcast on their respective radio channels that they were being shot at 

by the suspects in the SUV. 

38 Bringing Calm to Chaos: The San Bernardino Public Safety Response 
 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

After the SUV drove several hundred feet past Richardson Street, it slammed on its brakes, with the sergeant stopping approximately 210 feet directly behind the SUV while the deputy stopped his cruiser on 

the opposite side of the street, approximately 68 feet northwest of the SUV.71 

“As soon as the siren stopped and I put it in park, we were shooting at each other,” the deputy said, 

explaining that in the end, he was driving with his knee while holding his rifle pointing forward. More 

gunshots rang out. The female assailant opened the side passenger door and while lying on the SUV’s 

back seat shot at the deputy’s vehicle. The male assailant exited out of the driver’s front door, standing 

between the two open doors, and opened fire. He moved behind the front door of the SUV and shot as 

the sergeant headed to the back of his vehicle where he kept his AR-15. 

The deputy got out of his car, using the B-pillar (which separates the front and back doors) for protection while shooting before moving to the back of the car to continue firing. He kept moving and shooting 

because of the changing angles of the male assailant. 

At the same time, multiple other law enforcement vehicles came to a stop and officers engaged in the 

firefight. Some ran up to the sergeant’s vehicle while others used cars for protection or ran up through 

yards on the south side of the street. 

The male assailant fired from the front of the SUV and began moving away from the car into the opposing side of the street, firing repeatedly at the deputy’s vehicle, riddling it with bullets. Meanwhile, 

the female assailant continued shooting from the back seat of the SUV, sometimes blind-firing in the 

direction of the growing number of officers. Other times, she fired out of a hole in the rear hatch of 

the vehicle, which was created by her firing multiple rounds through it. 

As the deputy fired every gun that was available to him, consisting of a Mini-14, a shotgun, and a 

handgun, several officers realized the male assailant was trying to flank the deputy. They moved into 

better positions and trained their weapons on him. Their gunfire, along with the deputy’s, struck the 

male assailant in the legs and upper body. He dropped to the ground, dropped his AR rifle, and while in 

a seated position transitioned to his handgun and fired a round; then his weapon malfunctioned. 

Rounds continued to hit him and he tumbled to the ground. He tried to get up but took more gunfire, 

including to the head, and finally collapsed on the pavement. 

“When I saw him [the male assailant] moving I went back to the pillar, he was pointing at me and I didn’t 

know if he was shooting,” the deputy said. “Later, I learned he was. He went down ultimately where he 

was killed, but before that, he switched to a handgun, and I kept shooting. I saw a bunch of blood coming out. I knew he was out of the fight.” 

71 San Bernardino County Sheriff’s Department Homicide Unit, in discussion with Police Foundation staff, 

June 27, 2016. 

3. Police Response to Terrorist Shooting at Inland Regional Center 39 
 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

It wasn’t until 13 hours later that the deputy realized he had been wounded. While taking a shower, he 

noticed that he had some blood on his leg. He suspected that a piece of shrapnel or gravel had possibly 

hit him in the upper left thigh. 

The female assailant turned her weapon toward the officers, firing repeatedly. An SBPD narcotics officer 

was hit in the thigh; fortunately the wound was not life threatening. Another officer came to his side 

and quickly dressed the wound as the gunfight continued. 

Several officers used a cruiser for cover and shot at the back of the SUV while moving up to rescue the 

deputy and the wounded narcotics officer. Meanwhile, officers continued to fire into the SUV from multiple directions. The barrage of gunfire eventually put a stop to the female assailant’s attack after 13 bullets struck her body and two bullets struck her head. 

Once a cease fire was called for, the Redlands sergeant looked around him for the first time since the 

shooting began. “I couldn’t believe when I turned around and saw how many police officers there were 

standing behind the car,” the Redlands sergeant said. “That was quite a sight to see.” 

More than 175 law enforcement officers from various local, county, state, and federal agencies had 

arrived.72 Altogether, 24 officers fired at least 440 shots at the vehicle. Several officers felt bullets whizzing by as they exited their vehicles approximately 80 yards back, one later describing a scene so strangely serene that he could clearly hear his own breathing. The suspects fired at least 81 rounds at officers. 

72 San Bernardino Sheriff’s Department Homicide confirmed 177 officer reports and interviews of personnel on 

scene. 

Keeping the public informed 

The SBPD has two officers assigned to public information duties, but neither is a full-time position. While 

the department deals with high levels of violent crime, which leads to significant attention from reporters throughout the region, it had not dealt with an incident as significant as the December 2 attack. 

Vicki Cervantes, the SPBD’s backup public information officer (PIO), was the first public affairs–trained 

officer on the scene. She began trying to talk to the continuously increasing number of media arriving at 

the crime scene. Before long, some 70 to 80 reporters had arrived, each looking for information, each 

looking for a scoop. They surrounded Cervantes and began a barrage of questions, most of which she 

did not have answers to because the incident was still developing. 

Before leaving his office to head to the scene, Lieutenant Brad Toms, head of the SBCSD public affairs 

office, had tried to reach out by phone to the SBPD’s lead PIO, but he did not answer. Unbeknownst to 

Toms, the lead PIO was out of the office for a family emergency. 

40 Bringing Calm to Chaos: The San Bernardino Public Safety Response 
3. Police Response to Terrorist Shooting at Inland Regional Center 41 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

Members of the SBCSD’s public affairs unit (consisting of Lieutenant Toms, veteran PIO Cindy Bachman, 

and the department’s social media specialist, Brittany Rios) headed to the designated media staging 

area and met with Chief Burguan, where they saw Cervantes had been enveloped by the press. They 

asked Burguan if he would like their assistance, which he readily welcomed. 

Facing a series of major, media-frenzied incidents in two years may be more than any department would 

want to endure. But for the SBCSD’s public affairs unit, this incident provided opportunities to use lessons learned from other incidents. In the office, the SBCSD’s public affairs personnel answered calls that 

came in from all around the world. All of the information regarding the incident that could be released 

to the media was tracked on the department’s interactive electronic screen that can be seen from any of 

the desks in the office. “It’s the best way to ensure we are only releasing information deemed acceptable to be released to the public,” Lieutenant Toms said. “We stay much more consistent that way.” 

The office has four other 55-inch televisions that display different news channels. Some staff monitored 

news stations to listen to what sorts of questions were already being asked and to listen for rumors that 

might be circulating and need to being addressed. In an incident like this, rumors were rampant. 

A significant decision was made to include the PIOs in all command-level briefing and strategy sessions. That decision played a critical role in running the successful public affairs operation. “The reason we had the success we did was we could be with the sheriff and chief and FBI in those daily strategy 

sessions that was all unvetted information,” Lieutenant Toms said. “They listened to us, our folks were 

doing research on the press, what they were following and saying, so we could have proper answers 

for them.” 

Bachman added, “When we arrived at the media staging area, we were quickly hearing this might be a 

terrorist event, so I figured the FBI would show up. You expect the worst, the communication with the 

federal agencies. . . . But when we went into the first briefing, I could tell things were going to be different. They were not holding anything back, even with us general employees in the room. It was very surprising, in a very positive way.” 

Also in the meetings was Rios. She was hired to a full-time position in 2014 to handle all social media 

duties for the department. “We didn’t know how it was going to work, but I can say it was critical to the 

success of this event,” Lieutenant Toms said. 

Rios sent her first tweet at 11:18 a.m., announcing, “Hard Closure at Orange Show Rd/ Waterman and 

Park Center Circle in San Bernardino. AVOID THE AREA POLICE ACTIVITY!” 73 Eight minutes later, Rios 

reported via tweet that authorities had confirmed they had an active shooter. Altogether, she would 

tweet 42 times that day, with messages ranging from updated information to quotes from the multiple 

press conferences held that day. 

73 SB County Sheriff (@sbcountysheriff), “Hard Closure at Orange Show Rd/ Waterman and Park Center Circle in 

San Bernardino. AVOID THE AREA POLICE ACTIVITY!,” Twitter post, December 2, 2015, 11:18 a.m., 

https://twitter.com/sbcountysheriff/status/672132655052292096. 
 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

“Brittany would write out her tweets—she would have them all ready so she could copy and paste, and 

then put them out at the exact same time as the speakers were saying it,” Lieutenant Toms said. Using 

social media, particularly Twitter, proved critical for media operations. Reporters calling the SBCSD in 

search of information were told to follow the Twitter pages of the department, the SBPD, and the FBI. 

“It cut down a lot of work so we could do other more important work,” Toms said. Some of that other 

work included handling the growing number of elected politicians who arrived at the crime scene looking for information and in some cases looking to find a television reporter for an interview. 

Originally, Lieutenant Toms kept the department’s community relations officer, who also acted as the 

legislative liaison, at the headquarters to manage office operations. But before long, he realized that 

was a mistake. Toms brought the liaison down to the crime scene to talk face to face with elected officials and to keep them informed of important information as it developed. This allowed Chief Burguan, 

Sheriff McMahon, and Assistant Director Bowdich to concentrate their efforts on coordinating the overall response to the incident. 

According to the community relations officer, local legislators called to ask what they should say if the 

media wanted to interview them. The community relations officer told them that he could not tell them 

what to say, because the investigation was ongoing. He told the officials it would be more appropriate if 

they stayed off camera, allowing public safety to handle the task at hand. The SBCSD has made it a point 

to build long-term relationships with elected officials in their region, and as a result of these relationships the officials generally followed the recommendations to refrain from discussing the incident with 

the media. In some cases, the community relations officer received calls from elected officials who simply wanted to offer support, understanding the gravity of the situation. 

Early on, the SBCSD set up a 1-800 telephone number for people who were looking for information 

about potential victims. But because everything was moving so fast, the department did not have people manning the phones from the start, which initially led to problems. Eventually, employees manned 

all of the phones and were able to provide information to callers. 

Hundreds of witnesses 

Around this same time, just before 2:00 p.m., hundreds of county workers and IRC employees were 

moved from the San Bernardino Golf Course to the Rock Church, a “megachurch” that was only 1.2 

miles from the IRC building. Authorities knew they needed a large place to interview what would be 444 

witnesses, and the church leaders were willing to help. Local buses were used to transfer the witnesses 

to the site. 

As witnesses got off the buses at the Rock Church, they were broken into two groups: those who had 

actually seen the shooters and those who had not. About 90 percent had not seen them. Those witnesses were kept in a multipurpose room where church employees had scrambled to set up tables and 

snacks. 

42 Bringing Calm to Chaos: The San Bernardino Public Safety Response 
 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

A few dozen investigators had come to the church to conduct the interviews. Authorities realized it was 

going to be quite a challenge to track so many people. After some quick thinking, they began photographing each of the witnesses. On a whiteboard, which was used as background, they wrote each individual’s name and date of birth.74 

“We had a script for all of the investigators,” said a homicide sergeant. “For as chaotic as the situation 

could have been, the relationships with all of the agencies made it so it worked very well.” 

Many of the witnesses were frazzled from what they had just endured. Others simply wanted to go 

home because they had not seen anything but still found the ordeal troubling. Making matters worse 

was the fact that so many people’s cell phones had dead batteries and they expressed frustration that 

they couldn’t call loved ones when they felt a need to talk with someone. 

Some of the witnesses believed that there were not counselors present at the church. The witnesses 

were asked to stay apart and not share stories; then they formed lines to have their pictures taken and 

subsequently boarded buses for transport to the Hernandez Center. 

Once the interviews were complete, witnesses were taken back to buses and transported to the Rudy C. 

Hernandez Community Center, where they were reconnected with their significant others. The county 

probation department took charge of security there. City businesses and others kept coming, too, bringing food, water, and even some supplies. 

Adding to the tense and emotion-filled situation, the media found out that the Hernandez Center was 

the location where witnesses were taken. Reporters, photographers, and camera operators awaited 

their arrival, each wanting to ask questions. It was uncomfortable and unnecessary, as witnesses walked 

through a gauntlet of media as they departed buses at the center. 

Inside the center were several members of Counseling Team International, a locally based private 

practice that has contracts with multiple agencies in the area. The counselors met with some of the witnesses. Also on hand were several clergy members from the area who had self-deployed, wanting to 

help despite the fact that they had not been trained in critical incidents. 

“The Hernandez Center was perfect, it had everything, even private rooms for us to meet with people,” 

said Nancy Bohl-Penrod, the director of Counseling Team International. “And the community really 

helped. People just wanted to do something.” 

74 Incidentally and after the fact, officers lamented not also writing down the person’s contact information, the 

type of car they drove to work that day, and where they parked. 

3. Police Response to Terrorist Shooting at Inland Regional Center 43 
 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

Multiple scenes tackled by multiple agencies 

Chief Burguan, Sheriff McMahon, and Assistant Director Bowdich convened at the command post. The 

three leaders had been dealing with several unrelated swatting75 calls as well as other potential shooting 

incident calls. Several supposed active shooter calls came in at such places as the Patton State Hospital, 

a state-operated psychiatric hospital located in northeastern San Bernardino. At a nearby warehouse on 

the eastern border of the city (near where the suspects engaged police in a gun battle), employees 

called police after hearing gunshots from the ongoing shootout and believing they were in danger. 

After officers determined that those were false calls, key personnel from the SBPD, the SBCSD, and 

the FBI discussed the best course of action regarding each of the three scenes. Because it appeared the 

incident was likely to be related to terrorism, the law enforcement leadership team determined it would 

be best that the FBI processed the IRC and collected the evidence. Hence, the building was released to 

the FBI once it was tactically cleared by the SBCSD. The processing and evidence collection was done by 

FBI Evidence Response Team personnel in coordination with the SBCSD, who assisted by conducting 

360-degree scans of the crime scene. However, the SBPD still served as the on-scene commander at the 

IRC facility until Friday afternoon, when the investigation was officially classified an act of terrorism. The 

SBCSD took the lead at the officer-involved shooting scene, and the FBI took the lead at the assailants’ 

home in Redlands. 

75 “Swatting” is the act of deceiving law enforcement agencies with fake emergency calls. 

The officer-involved shooting scene 

The male assailant’s body had been handcuffed and was lying face down on the ground. The female 

assailant remained in the back seat and was believed to be dead—but authorities, aware that there 

could be explosive devices in the vehicle or on the suspects, took precautions to protect the community 

and themselves. 

Several armored vehicles, belonging to the IVS team, responded to the shooting scene. One of the vehicles pushed up to the front of the SUV to ensure it was not going anywhere, and another did the same at 

the rear. Authorities discussed how to proceed. Someone suggested throwing a flash-bang grenade in 

the SUV to see if the female assailant was dead, but that idea was quickly quashed for fear of explosives. 

Someone with the IVS team suggested using their relatively new piece of equipment—the Rook, a 

motorized battering ram with a protective shield—which would allow officers to get close and see inside 

the SUV. 

44 Bringing Calm to Chaos: The San Bernardino Public Safety Response 
 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

A Rook armored vehicle 

Photo: Inland Valley SWAT 

Standing in the payload of the Rook, a SWAT officer used a probe to see if the female assailant was still 

alive in the SUV. It quickly became apparent she was dead. The Rook’s probe was then used to pull the 

female assailant’s body out of the SUV and onto the street. 

At the same time, multiple teams of officers scoured the neighborhood. Because the original call at the 

IRC suggested there were as many as three shooters, authorities wanted to be sure a third suspect had 

not escaped. Compounding matters was a report of a man running from the scene who was detained, 

interviewed, and released after it was determined he was uninvolved in the terrorist attack. Ultimately, 

authorities determined that there was not a third suspect. 

Once the SUV and the area around it were determined to be safe, SBCSD investigators went to work 

processing the crime scene. The integrity of the crime scene was disrupted by the need to quickly search 

the assailants and the inside of the SUV to ensure no explosive devices were present. 

At the same time, agents from several different federal agencies arrived with specific tasks that did not 

fit in with traditional homicide investigations. An agent from one of the federal agencies began examining the guns prior to the arrival of homicide investigators. Each shooter had a .223-caliber rifle and a 

9-mm handgun. The male assailant’s rifle had been modified in an attempt to make it fully automatic, 

but because it was handmade and done poorly, authorities determined it was at best semiautomatic. 

Another agent came to collect the electronics, consisting of a cell phone, a tablet, and an MP3 player. 

3. Police Response to Terrorist Shooting at Inland Regional Center 45 
 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

It became frustrating for the some of the local investigators who were still in the initial stages of the 

officer involved shooting investigation. “There was no point of contact on the federal side,” a sheriff’s 

homicide investigator said. “We kept getting waves of agents. Some of them were helpful. But some 

were asking for things they had already gotten.” Eventually, after conversations with the involved agencies’ leadership, supervisors at the scene had an understanding of the agreed-upon roles each agency 

was to perform and the tasks associated with those roles. 

As the investigators conducted their work, they determined the two shooters had fired at least 81 shots 

at police officers. The investigators found an additional 1,879 rounds of .223 ammunition and another 

484 rounds of 9-mm ammunition inside the SUV. Some of the rounds were in an ammunition canister 

while still more were in a black backpack. They also discovered that the assailants had taped ammunition magazines together to make switching them out easier. Inside the SUV, investigators also found 

what they believed was the trigger apparatus intended to be used to detonate the secondary devices 

found at the IRC. 

The shooters had medical supplies in a blue backpack. These supplies consisted of ibuprofen pills and 

several quick-clot agents including tourniquets, emergency bandages used for traumatic wounds, and 

even adult diapers possibly to act as absorbing bandages. They were not wearing body armor. They 

wore all black clothing, including ski masks, and load-bearing vests. They both wore Airsoft neck 

guards—used to stop plastic pellets in a military simulation game—which was curious because that 

equipment would have done nothing to stop bullets. 

Their bodies were transferred to the morgue. The male assailant had 25 wounds, most of which were to 

his legs. He also sustained a gunshot wound to his chin that fragmented into his neck. The female assailant sustained two shots to the head and 13 others to her body. 

The coroner: Investigation and notifications 

With the investigation underway and the secondary explosive devices rendered safe, the coroner’s 

office began the slow and methodical work of removing the deceased victims from the IRC. In the meantime, coroner’s officials visited the scene and then the Hernandez Center. Then they returned for a staff 

meeting. All employees’ days off were canceled and staff were put on 12-hour shifts to work around the 

clock. 

Officials also determined that the Hernandez Center was the wrong place to make death notifications 

for family members because of the number of witnesses, their family members, and the media. They 

chose a Hampton Inn in the northeast corner of the city, far from downtown. The lack of media presence allowed coroner’s officials a more private place to make the notifications. 

46 Bringing Calm to Chaos: The San Bernardino Public Safety Response 
 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

“A lot of people weren’t leaving,” a captain from the coroner’s office observed. “At some point, they 

began to realize there weren’t going to be more buses. We needed people there to help when the families realized that the rest of the victims weren’t coming on a bus. We began meeting with them and letting them know that their loved ones might be gone.” 

Eventually, victims’ bodies were carefully moved to the coroner’s office, which was handled by staff, not 

the usual transport companies that the coroner’s office uses. This was another decision made by coroner’s officials who felt it was the right thing to do. That task was not complete until late into the following day. 

The San Bernardino Coroner’s office made all notifications to victims’ families in person. However, some 

family members were frustrated and angry that it took so long to be notified. According to the captain 

assigned to the coroner’s office, “They were already expecting it. They were already prepped for it. They 

just needed to know.” The captain explained that the coroner’s division policy is being reviewed to 

improve their notification protocols and to ensure consistency with best practices. 

All of the victims’ autopsies were completed by December 7. The assailants’ autopsies were conducted 

on December 8. Their bodies were released to family members, who had them buried in an undisclosed 

location. 

“They were already expecting it. They were already prepped 

for it. They just needed to know.” 

The media frenzy 

On December 4, one day after the FBI finished its investigation of the Redlands home rented by the 

assailants, the older couple who owned the home were contacted by a media organization about gaining access to the house. Although the owners originally agreed, they were unaware of the scores of 

other media organizations this would draw. On the day that they allowed the one specific organization 

access, scores of other media overwhelmed the couple and entered the home with cameras and microphones without permission, some even broadcasting live from the home. With the help of the Redlands 

Police Department, the couple had all of the media removed, but not before the media had taken over, 

leaving the homeowners feeling vulnerable and violated. 

3. Police Response to Terrorist Shooting at Inland Regional Center 47 
 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

The aftermath 

In the days that followed, the investigation continued. Multiple press conferences were held, first led 

by Chief Burguan but then taken over by Assistant Director Bowdich76 and the FBI once the attack was 

determined to be an act of terrorism. 

That first night, all 24 law enforcement members who fired their weapons during the officer-involved 

shooting were interviewed at the sheriff’s headquarters. Members of the counseling team were on 

hand, ready to talk to anyone who needed it. 

Mental health counseling was offered in varying degrees in all of the local agencies that were involved 

in the case. Some departments made it mandatory for everyone involved; others made it voluntary for 

officers who fired their weapons or spent time inside the IRC. 

Dr. Bohl-Penrod said the law enforcement community in general must realize it has to do more for 

its own people. Too often, she said, seeking therapy continues to carry a stigma for too many police 

officers. “If you tell them to go, then it’s not them needing to go,” Bohl-Penrod said, as she described 

some of the officers’ later issues, including one officer who struggled to even look at a Christmas tree 

because it brought back memories of three dead victims found next to the tree in the conference room. 

An employee from one of the involved police agencies told the Police Foundation (PF) team that he 

would tease any coworker for attending a mental health debriefing, which points to the negative culture 

that remains in many law enforcement agencies regarding mental health services. A police supervisor 

who entered the IRC said, “It’s almost seen as a ‘badge of discourage’ if you speak out and have problems. We need to show some degree of empathy for these people.” 

Local officials organized a variety of vigils in the days and weeks that followed. Often, officers who were 

heavily involved in the case attended and had the opportunity to talk with survivors. Sometimes, there 

were just hugs exchanged. “People have seen things they just should never have to see,” an SBPD officer 

said. “Cops, victims, all of us. There’s definitely some help that comes with those times. But this is something that won’t leave anyone who was part of it. Ever.” 

76 Assistant Director Bowdich was appointed Associate Deputy Director of the FBI by Director James Comey in 

February 2016. 

48 Bringing Calm to Chaos: The San Bernardino Public Safety Response 
 

 

Timeline 

The following timeline was provided in internal documents to the PF team by the San Bernardino County 

Sheriff’s Department (SBCSD). All times are Pacific Standard Time. 

10:58 a.m. First report of five rounds heard in the 1300 block of S. Waterman Ave. 

10:59 a.m. Report of three suspects armed with assault rifles wearing all black clothing. 

11:00 a.m. Two patrol units dispatched. 

11:04 a.m. First unit arrives on scene (Lieutenant Mike Madden). 

11:06 a.m. Lieutenant, detective, motor, and patrol officer form a contact team and make entry. 

11:09 a.m. San Bernardino Police Department (SBPD) special weapons and tactics (SWAT) team 

arrives with twelve operators and a tactical medic (six more arrive later). 

11:15 a.m. Triage area established at S. Park Center and Waterman Ave. 

11:17 a.m. First floor secured. Patient evacuation to triage area. 

11:26 a.m. Roof cleared. 

11:30 a.m. Directed Probation to set up containment area for those exiting Bldg. #1. 

11:31 a.m. Secondary sweep of building. 

11:33 a.m. Possible device found on 2nd floor office (roller luggage bag out of place). 

11:46 a.m. SBCSD Explosive Ordinance Disposal (EOD) on scene. 

11:51 a.m. EOD determined device was suspicious. 

11:56 a.m. SBCSD Special Enforcement Division (SED) cleared Bldg. #1. 

12:24 p.m. Inland Valley Regional SWAT (IVS) team to 2nd floor of Bldg. #1 to clear and evacuate. 

3. Police Response to Terrorist Shooting at Inland Regional Center 49 
50 Bringing Calm to Chaos: The San Bernardino Public Safety Response 

12:38 p.m. Unified tactical command post established with SBPD, SBCSD, and Inland Valley SWAT 

team. The FBI joined later but was on standby to assist if needed at other locations. 

1:42 p.m. Robot deployed to X-ray suspicious package. 

2:22 p.m. X-ray complete, device deemed safe. 

2:35 p.m. SBCSD completes search and evacuation of Bldgs. #1 & #2. 

3:02 p.m. Redlands Police Department in 100mph pursuit of unrelated stolen car that terminates 

1/2 mile from command post. 

3:02:17 p.m. SBPD narcotic unit flagged down Redlands Police Department sergeant. 

3:08:19 p.m. SBPD narcotics and Redlands Police Department following suspect vehicle eastbound 

between San Bernardino Avenue and Richardson. 

3:08:43 p.m. Shots fired while officers attempt to stop suspect vehicle. 

3:09 p.m. Suspect in custody form the Redlands Police Department stolen vehicle pursuit (Orange 

Show Rd. and Arrowhead). 

3:09:22 p.m. Suspects stop and gun battle ensues (1795 E. San Bernardino Ave.). 

3:12 p.m. Bearcat (armored vehicle) requested. 

3:12:57 p.m. ***Officer Down *** Narcotics officer shot in left thigh with .223 round @ corner of 

Shedden and San Bernardino. 

3:14:53 p.m. Shooting stops. 

3:19 p.m. SED units searching for potential third suspect seen running from the area of the SUV. 

3:19 p.m. Bearcat on scene. 

5:08 p.m. Explosive devices located on 1st floor primary building. 

7:36 p.m. Device removed for destruction. 

7:54 p.m. Device #1 detonated / rendered safe. 

8:33 p.m. Device #2 detonated / rendered safe. 

8:37 p.m. Device #3 detonated / rendered safe. 

9:29 p.m. Building clear and released to investigators. 
 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

Section III. Analysis and Lessons Learned
 

4. Leadership 

Leadership—both internal and public-facing—in any crisis is critical to reducing chaos. Leadership 

requires bringing a sense of order through composed and experienced decision making, in many cases based upon limited and constantly evolving data and information. The shooting at the Inland Regional Center (IRC) was a mass casualty terrorist event with secondary devices and an alleged continuing 

assault plan by the suspects, a search for the suspects, and a public shootout. The leadership necessary 

to manage even the smallest components of these events was critical not only to eliminating the threat 

but also to preventing additional casualties, informing the public, reducing fear in the community, and 

restoring calm. Many people, regardless of rank or position, assumed leadership roles during the events 

as they unfolded and in the days and weeks that followed. 

Examples of leadership can be seen throughout the narrative describing the events of December 2, 

2015, and the days that followed. Based on information gathered through interviews of those present 

at the IRC that day, the Police Foundation (PF) team identified trust, critical incident debriefs, organizational awareness, teamwork, and managing elected officials as leadership skills that enhanced the response to the shooting at the IRC. 

Trust 

Throughout the review, many examples of how previously established work relationships revealed 

themselves as key to the public safety response to the IRC. Trust developed over time through shared 

operational experiences, commitments to regionalized training, and the resulting personal connections 

that were established before the incidents at the IRC demonstrated the close working relationships that 

existed among public safety agencies in the region. Trust by its nature improves collaboration as was 

seen within the executive leadership at the unified command post. 

51 
 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

Previous critical incident debriefs and reports 

Law enforcement executives credited their well-established relationships with incident command, interagency collaboration, and media relations at the IRC. The executives commented on lessons learned 

from other critical incidents, including the Christopher Dorner incident review77 and their ability to apply 

those lessons during this incident. Law enforcement leaders recognized the need for expanded relationships with fire, emergency medical services (EMS), and emergency management officials going forward. 

The critical incident reviews helped public safety officials recognize the need for more regional interagency and interdisciplinary active shooter and mass casualty training. Law enforcement leaders emphasized the need to engage fire and EMS agencies in the planning, training, and exercise process. It was 

also noted that law enforcement specifically needed more training in the incident command system 

(ICS) and needed to practice ICS principles on a regular basis and during routine operations. 

Some law enforcement leaders suggested creating a regional law enforcement ICS response team 

similar to the regional fire service team. There was also considerable discussion regarding the need for 

unified command and command post training to ensure interagency communication and coordination of 

efforts. The InterAgency Board (IAB) recommends that all-hazards standing committees be established 

in local jurisdictions and communities and be “responsible for integrating responder assets, organizations, and disciplines to include active shooter / hostile events. Such a committee should include representation from local, state and federal law enforcement; jurisdictional and county EMS; local fire and 

rescue; local and state emergency management; and local 911, public safety answering point (PSAP), 

dispatch, and communication.”78 

The InterAgency Boar d 

Sanct ioned by the Attorney General of the Unite d States, the Int erAge ncy Board (IAB) 

was founded in 1998 by the U.S. Department of Defense’s Co nsequence Management 

Program Integration Office and t he U.S. Department of Justice’s Federal Bureau of 

Investigation Weapons of Mass Destruction Countermeasures. The mission of t he IAB 

is to strengthen the nation’s ability to prepare for and re spond safely and effect ively 

to emergencies, disasters, and chemical, biological, radiological, nuclear, and high 

yield explosive (CBRNE) incide nts. 

77 The level of cooperation and collaboration between agency leadership greatly improved the overall outcome of 

the response and investigation in the Dorner review. Police Under Attack (see note 1). 

78 Improving Active Shooter/Hostile Event Response: Best Practices and Recommendations for Integrating Law 

Enforcement, Fire, and EMS (Arlington, VA: The InterAgency Board, 2015), 9, 

http://www.interagencyboard.org/sites/default/files/publications/External%20IAB%20Active%20Shooter%20Sum 

mit%20Report.pdf. 

52 Bringing Calm to Chaos: The San Bernardino Public Safety Response 
 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

At the agency level, agencies use after action reports (AAR) to learn from incidents internally— 

identifying both what worked and what did not. For example, the San Bernardino City Unified School 

District conducted almost 100 AARs regarding the response to the active shooter or other hostile event 

from their facilities and personnel all over the city. As part of this review, the PF analyzed the AARs. 

Results can be found in appendix B of this report. 

Organizational awareness 

The team observed varying degrees of organizational awareness as it related to the emotional support 

of employees involved in responding to the terrorist attacks. However, the majority of leaders involved 

in the incident demonstrated a sincere concern for first responders and victims. These leaders did everything from providing peer support to offering private and public recognition of the difficulty experienced 

by responders to requiring counseling. 

Literature on the subject supports the importance of this approach. Pillar six of the Final Report of the 

President’s Task Force on 21st Century Policing states, “Support for wellness and safety should permeate 

all practices and be expressed through changes in procedures, requirements, attitudes, and behaviors. 

An agency work environment in which officers do not feel they are respected, supported, or treated fairly is one of the most common sources of stress.”79 

It is critical that leaders remain focused on the needs of their employees and their community members, 

and avoid being distracted by the ever-present media attention or the potential for future litigation. 

Some personnel interviewed shared their frustration with how leadership appeared to be more concerned about media attention or litigation than about the resiliency and welfare of the employees or 

victims affected by the incident. By seeming to place media attention and potential litigation above the 

needs and concerns of victims and responders, leaders can run the risk of losing credibility and legitimacy within their organizations and possibly with the community. 

Officers suffer high levels of stress every day, including difficult and even hostile work environments and 

individuals, responding to tragic events, and coming under fire themselves, but the most acute stress 

“often comes from their agencies, because of confusing messages or nonsupportive management.”80 

79 President’s Task Force on 21st Century Policing, Final Report (see note 4), 62. 

80 Ibid. 

4. Leadership 53 
 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

“Research suggests that people are more resilient when agency officers are able to support each other, 

and they know that agency leaders care about their well-being.”81 For this reason, Usher and colleagues 

recommend that leaders take a personal interest in officer wellness and be present and visible for officers after a critical incident to enhance resilience within the department.82 

81 Laura Usher et al. Preparing for the Unimaginable: How Chiefs Can Safeguard Officer Mental Health 

Before and After Mass Casualty Events (Washington, DC: Office of Community Oriented Policing Services, 2016), 

http://ric-zai-inc.com/ric.php?page=detail&id=COPS-P347. 

82 Ibid. 

Teamwork 

Successful response to any critical incident is not determined solely by the leader or leadership acting alone but rather by assembling a team that can work effectively and efficiently. Ideally, these teams 

should be created prior to a critical incident, but as demonstrated at the IRC, there are many examples of successful ad hoc teams that form out of necessity. For example, an ad hoc team formed to 

staff the Joint Information Center (JIC) at the IRC. The JIC included staff from all of the law enforcement 

agencies involved in the response and personnel of different ranks including civilian employees. Team 

members, regardless of rank, were included by the executive leaders and encouraged to share their perspectives as the team discussed many aspects of the response and investigation. The idea was that the 

more diverse the team, the better the outcome, which was to inform the public in a manner that was 

timely, accurate, and as thorough as possible. To accomplish this, the executive leaders included everyone in crafting and communicating the message. 

Managing elected officials 

In interviews with public safety personnel and local elected officials, it was clear that some elected officials did not clearly understand their roles while others seemed too concerned about being interviewed 

by the media. As one local elected official pointed out, “Politicians from outside the area were out to 

further their political cause and get camera time. Why can’t we just let them bury their loved ones? 

Everything political takes away from the victims.” Several local officials noted that they believed 

their role was to help calm the community, to assist in ensuring factual information was provided to 

the community, to ensure resources were available to the responders and victims, and to allow law 

enforcement to do their job. 

It is critical that leaders remain focused on the needs of 

their employees. 

54 Bringing Calm to Chaos: The San Bernardino Public Safety Response 
 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

Leadership lessons learned 

Leadership during the San Bernardino terrorist incident set the stage for the response to the attacks. 

Less obvious was that the leaders also set the foundation for the aftermath of the incident, including 

how well their departments and their community will recover and respond to future events. 

Ensure equity in care for department personnel and victim wellness 

4.1 Organizational leadership should ensure that all involved in the response feel valued and are provided access to the physical and mental health resources they may need after a critical incident. Agencies 

should identify best practices related to employee wellness. 

The team heard from responders and in some situations personally observed a wide range of leadership responses to employee welfare from mandatory counseling visits for all employees involved in the 

response to the IRC to casual mention but no requirement of services. The recommended leadership 

response is best illustrated when a department leader preparing for a review team group interview 

reminded first responders of the importance of employee welfare and the availability of peer support 

and mental health providers. During the interview, team members observed employees struggling emotionally as they described the events at the IRC. A supervisor in the room also took note and requested 

the assistance of mental health providers who arrived before the interviews concluded. 

In a recently released report from the Office of Community Oriented Policing Services (COPS Office) and 

the National Alliance on Mental Illness (NAMI), experts make clear that addressing officer mental health 

before, during, and after a mass casualty incident is imperative.83 In addition, the International Association of Chiefs of Police (IACP) recommends having “an established, vetted protocol to address mental 

wellness policies after critical incidents.”84 

83 Ibid. 

84 International Association of Chiefs of Police, Breaking the Silence on Law Enforcement Suicides: IACP National 

Symposium on Law Enforcement Officer Suicide and Mental Health (Washington, DC: Office of Community 

Oriented Policing Services, 2014), 15, http://ric-zai-inc.com/ric.php?page=detail&id=COPS-P281. 

4. Leadership 55 
Leverage lessons learned 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

4.2 Regularly review the lessons learned from critical incidents with regional first responders and 

develop trainings that incorporate lessons and promising practices. 

The PF team heard from first responders representing a variety of organizations that the ability to selfreflect and learn from the critical incident review done in 2013–2014 following the events precipitated 

by Dorner was critical to the success of the response to the December 2 terrorist shooting. The ability to 

learn, adapt, and improve based on prior events and past experience assisted the agencies involved in 

controlling the chaos and improving response performance. 

Be inclusive 

4.3 Include representatives from all levels of the organization in critical decisions to enhance 

outcomes. 

“When people come together from different disciplines and backgrounds, there is a cross-fertilization 

of ideas that often leads to better solutions. Furthermore, by interacting with a more diverse group of 

professionals, police can establish a valuable network of contacts whose knowledge and skills differ 

from but complement their own.”85 The San Bernardino Unified Command Center allowed a variety of 

ranks and civilian employees to participate in critical decision-making conversations ranging from tactical assignments to media strategy. The variety of thought and experience improved the outcomes without slowing the process. 

“People acting together as a group can accomplish things which no 

individual acting alone could ever hope to bring about.” 

— President Franklin Delano Roosevelt 

85 President’s Task Force on 21st Century Policing, Final Report (see note 4), 55. 

56 Bringing Calm to Chaos: The San Bernardino Public Safety Response 
Define rolesand responsibilities forelected officials 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

4.4 Predetermine elected officials’ roles and responsibilities in managing critical incidents, and include 

them in critical incident training and exercises. 

Elected officials will and should respond to critical incidents in their communities. They play an important role in providing leadership and a sense of calm to their citizens. However, it is important that those 

elected officials understand the roles and responsibilities that will be helpful in bringing resolution to 

the incident and what actions they take that could hinder progress and healing. 

Stay grounded 

4.5 The intense media coverage associated with a high-profile event is often overwhelming and will 

place additional demands on leaders that may take them away from daily operations. These demands 

will continue long after the conclusion of the incident, requiring leaders to constantly assess the effects 

the increased attention and notoriety bring on themselves and the organization. 

Publicly recognize collaboration 

4.6 Publicly demonstrate and recognize the collaboration and support from others. 

In San Bernardino, the chief of police, the sheriff, and the FBI assistant director stood together at all 

press conferences. They also included other public safety leaders and first responders in media briefings 

as a symbol of the trust that had been established prior to and during the event. 

4. Leadership 57 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

5. Command and Control
 

A coordinated and collaborative command and control strategy is critical to a response and resolution 

of complicated multijurisdictional incidents. The public safety response to the San Bernardino terrorist 

attacks demonstrates the importance of command and control in accomplishing several different missions across multiple disciplines and agencies. 

This review examines the challenges associated with maintaining command and control as responding 

agencies were thrust into a chaotic terrorist attack that included multiple casualties and sites, secondary 

devices, and an aggressive search for the suspects that concluded with an extensive gun battle killing 

both terrorists. 

The findings affirm the more significant issues of collaboration across public safety disciplines and jurisdictional authority and the implementation of the National Incident Management System (NIMS)86 and 

California Law Enforcement Mutual Aid System.87 NIMS is a “systematic, proactive approach to guide 

departments and agencies at all levels of government, nongovernmental organizations, and the private 

sector to work together seamlessly and manage incidents involving all threats and hazards,” including 

the response to the IRC shooting, investigation, and search for the responsible suspects.88 Emergency 

responders use different components of NIMS to conduct operations so that responders at all levels 

can work together more effectively and efficiently. Incidents such as this draw a response of many law 

enforcement agencies, fire departments, medical transport agencies, and emergency medical facilities. The ability to respond in a coordinated manner does not happen by accident but is a product of a 

regionwide commitment to NIMS and the requisite preparation and training. 

In reviewing command and control issues, the team identified two overarching categories of focus: 

(1) incident command, including the use of command posts, and (2) self-deployment. 

86 The National Incident Management System is currently being revised to reflect and incorporate promising 

practices and lessons learned, changes in national policy, and updates to the National Preparedness System. More 

information about the revision and the most recent draft can be found at “Documents Available for National 

Engagement,” Federal Emergency Management Agency, last modified May 11, 2016, 

https://www.fema.gov/national-incident-management-system/national-engagement. 

87 Governor’s Office of Emergency Services, “Mutual Aid System,” State of California, accessed June 21, 2016, 

http://www.caloes.ca.gov/cal-oes-divisions/law-enforcement/mutual-aid-system. 

88 “National Incident Management System,” Federal Emergency Management Agency, last modified May 11, 2016, 

http://www.fema.gov/national-incident-management-system. 

59 
 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

Incident command and command posts 

The lessons learned from the 2013 report Police Under Attack: Southern California Law Enforcement 

Response to the Attacks by Christopher Dorner89 played a critical role in reducing or eliminating errors 

that may have occurred in the response to the December 2 terrorist attack. According to many law 

enforcement leaders in San Bernardino County, the ability to review and critique the response greatly 

prepared them for an improved response to the Inland Regional Center (IRC) shooting. The use of incident command, while not as robust and timely as many first responders would have hoped, was nonetheless significantly improved from the 2013 Dorner response. 

During the initial response to reports of an active shooter at the IRC, leadership fell to the first 

on-scene personnel, which included a lieutenant from the San Bernardino Police Department (SBPD). 

As additional personnel from a variety of agencies began arriving, incident command unintentionally 

became decentralized as law enforcement first responders rushed in to locate the suspects, secure the 

scene, and rescue victims. While an initial command structure was established within eight minutes, not 

until the arrival of other public safety leaders with enhanced experience in incident command did the 

formalized unified incident command leadership structure emerge. 

It is critical to note that while law enforcement personnel were securing the scene, San Bernardino 

Fire Department (SBFD) responders were waiting for a “safe to enter” notification. During this time, 

the SBFD was predesignating roles and responsibilities within the Incident Command System (ICS) to 

responding fire personnel. When they received notification, incident command roles and responsibilities 

were already clearly delineated. 

The Police Foundation (PF) team noted that as the incident continued to evolve, unified incident command became more evident and coordination between emergency responders greatly improved. 

Self-deployment 

As noted in previous critical incident reviews,

90 basic law enforcement training teaches officers to handle situations on their own or in pairs. They are trained to seek opportunities to perform the tasks 

assigned to them and self-initiate in the interest of public safety. Agencies measure and evaluate officers 

in part based on self-initiated activity. “Self-initiated” activity is the response to a situation witnessed by 

an officer or in response to a scene where the officer may take immediate action to assist in an evolving, 

ongoing incident. “Self-deployment” is the independent action of an individual or individuals to an incident without the ability to immediately intervene in an ongoing situation or without a request from the 

jurisdiction in command. 

89 Police Under Attack (see note 1). 

90 Ibid., 53. 

60 Bringing Calm to Chaos: The San Bernardino Public Safety Response 
 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

The initial response to the IRC involved many law enforcement officers from several different agencies. 

While the number of law enforcement personnel was overwhelming,

91 it was justified at the time given 

the scope of the incident, the limited information about the suspects and their location, the numbers 

of wounded victims, and the size of the IRC complex. While most of the officers on scene were not formally dispatched, their response was not considered self-deployment. For example, officers who were 

not SBPD members were driving through the city and responded when they noticed the unusual flight 

behavior of a San Bernardino County Sheriff’s Department (SBCSD) helicopter. These officers were part 

of the second team to enter the building when they were able to determine that the helicopter was over 

the IRC and the SBPD was responding to an active shooter. 

While the number of officers who initially responded to the IRC was necessary, the manner in which 

they responded lacked coordination, adding to an already chaotic scene. Many officers were not in uniform, and many were driving unmarked vehicles. In addition, there was limited appreciation of the consequences of unattended police vehicles blocking access routes to critical responding personnel such as 

tactical units, fire, and emergency medical services (EMS). The duties of monitoring traffic and keeping 

lanes of traffic open fell to a few officers who took command of the parking situation. In many cases, the 

routes were blocked with no way to quickly locate the driver. This led to delays in response of critical 

tactical assets. 

As information developed regarding the identities of the possible suspects, the urgency to capture the 

suspects and the resulting shootout contributed to more individuals self-deploying. Numerous officers 

took independent actions in an attempt to locate the suspects. Some officers left preassigned positions 

at or near the IRC without notifying incident command and responded without adequate situational 

awareness. The uncontrolled numbers of officers responding and lack of parking discipline again caused 

roads to be blocked and resulted in a delay of critical tactical assets being available during the officerinvolved shooting. In addition, many of the responding officers arrived at the shooting scene after the 

shooting had stopped. 

The different teams working independently and without secure interagency radio communication 

capability created a lack of coordination between agencies. This lack of situational awareness among 

responding officers resulted in a patrol sergeant driving the wrong way against traffic and stopping 

nearly parallel to the suspects, who were waiting at a red light. It appears that through this action, the 

patrol sergeant alerted the suspects to a police presence. This alert prompted the suspects to don tactical vests and control how they were going to engage officers. Further complicating limited command 

and control in the search for the suspects was the need to surveil the suspects and limit radio traffic. 

When the suspects were finally located, the absence of prior communication with responding officers 

resulted in limited coordination, no tactical prestaging of personnel and equipment, and an absence of 

pre–vehicle stop planning. 

91 A list and description of all responding agencies can be found in chapter 1 of this report. 

5. Command and Control 61 
 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

While many of the officers who responded were necessary to contain the suspects and rescue wounded and trapped officers, a greater number of officers was not needed and impaired the access of necessary personnel and equipment. Individuals interviewed by the PF team believed that some officers from 

remote locations of San Bernardino County as well as those outside San Bernardino County responded 

merely to say that they were there. 

Command and control lessons learned 

The public safety response to the San Bernardino terrorist attacks demonstrates the use of command 

and control in accomplishing several different missions across multiple disciplines and agencies. 

Conduct, review, and use lessons learned 

5.1 Agencies should routinely examine critical incident reviews and plan at a regional level for the possibility of similar events. 

The review of previous critical incidents—such as the attacks by Dorner—greatly improved the response 

by San Bernardino area law enforcement to the IRC. Even after the December 2 attack, organizations like 

the San Bernardino City Unified School District (SBCUSD) conducted after action reviews, which will provide them with valuable information for improving their response to critical incidents in the future.92 

Identify ways to incorporate ICS into daily operations 

5.2 Agencies should use ICS beyond large-scale tactical events and incorporate as many of the principles as possible in response to routine emergencies so it becomes a regular component of a department’s 

operating philosophy.93 

The fire service can serve as a model of how the routine use of ICS and NIMS greatly improves performance during critical incidents. In critical incidents, particularly events involving multiple jurisdictions, 

the understanding and use of NIMS is essential to the successful sharing of information and coordination 

of resources, investigations, and tactics. 

92 An analysis of SBCUSD Police Department after action reports are included in this report as appendix B. 

93 Bruce Martin, “Active Shooter: Who’s in Command—You Or the System?” Homeland Security (blog of a public 

safety leader, HLS collaborator, and educator), July 6, 2014, https://medium.com/homeland-security/activeshooter-whos-in-command-51c3f13c1987#.a3jelfwuw. 

62 Bringing Calm to Chaos: The San Bernardino Public Safety Response 
Regularly organize, plan, and exercise unified command 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

5.3 Regional public safety partners should plan and exercise unified command for complex incidents on 

a regular basis. This includes law enforcement, fire, EMS, and emergency management as well as other 

government and nongovernment agencies as appropriate. 

The SBCUSD Police Department, in coordination with the SBPD and the SBFD, conducted an active 

shooter drill in 2013 that tested the core capabilities of unified command, victim extraction, and 

triage and “medical-surge” at area hospitals. Other law enforcement agencies and fire departments 

discussed regional active shooter drills that had been conducted as well as the benefits of interdisciplinary cross training. Officers previously unknown to one another worked effectively as the initial 

responders because of these regional training efforts. 

5.4 As soon as possible and practical during an incident, establish a unified command of all primary 

first responders to facilitate communication, situational awareness, operational coordination, allocation 

of resources, and delivery of services. 

As observed in San Bernardino, agencies with established relationships demonstrated improved collaboration and understanding of others’ abilities and limitations. The Federal Emergency Management Agency (FEMA) identifies pre-existing relationships as critical to emergency coordination and response. When 

prior relationships exist, collaboration improves and the resulting outcomes are enhanced. 94 

Designate astaging area manager 

5.5 After adequate personnel are on scene, additional personnel should be directed to staging areas 

for assignment of duties. As described in a variety of NIMS courses,

95 designating a staging area manager is critical during the early moments of the response.96 

Agencies should consider the need for more than one staging area depending on the size and scope of 

the operation and ensure communication between leadership at different staging areas. For example, 

separate staging areas may be required to facilitate tactical units or aircraft. 

94 See U.S. Fire Administration, Fire/Emergency Medical Services Department Operational Considerations and Guide 

for Active Shooter and Mass Casualty Incidents (Washington, DC: Federal Emergency Management Agency, 2013), 

3, https://www.usfa.fema.gov/downloads/pdf/publications/active_shooter_guide.pdf. 

95 Emergency Management Institute, “National Incident Management System (NIMS),” Federal Emergency 

Management Agency, accessed June 22, 2016, https://training.fema.gov/nims/. 

96 The NIMS Staging Manager Checklist is a good starting point for personnel assigned to staging manager duties. 

Staging Area Manager Position Checklist (Washington, DC: Federal Emergency Management Agency, 2012), 

https://training.fema.gov/emiweb/is/icsresource/assets/sam_pcl.pdf. 

5. Command and Control 63 
Expect and manage the chaos 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

5.6 Agencies must plan for potential chaos created by public safety personnel responding to an active 

shooter. 

An active shooter incident is by its very nature chaotic. The manner in which public safety personnel 

respond can add to or reduce the level of chaos. Undisciplined responses can gather momentum to create additional chaos. To avoid this, personnel should be provided with the right information to improve 

situational awareness, and self-deployment should not be left unchecked. 

5.7 Agencies should anticipate and plan a timely transition from the somewhat chaotic active shooter 

response to a more methodical search for possible suspects, triage of victims, and victim and witness 

extrication. 

Evaluate security of command post location 

5.8 Responders should constantly evaluate security risks of command post locations and make appropriate adjustments as required. 

Initial command post locations may inadvertently be located in an area later determined to be at risk for 

secondary devices or attacks. 

5.9 Send pictures or maps of the area—building layouts, parking lots, streets, and the like—to dispatch 

and vehicle mobile data terminals (MDT). Employ technology, such as such as helicopters, unmanned 

aircraft systems (UAS), or pre-existing camera systems (as available) to produce information in real time. 

Providing as much contextual information as possible to dispatch and MDTs provides officers on the 

ground with additional information from which to operate. 

An active shooter incident is by its very nature chaotic. 

64 Bringing Calm to Chaos: The San Bernardino Public Safety Response 
Self-deployment 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

5.10 It is the responsibility of each first responder to assess a situation while en route to an active 

shooter incident as well as after arriving to determine if they are needed as part of the response. If an 

officer has initiated action at a scene or been assigned a specific task the officer should not leave unless 

directed to do so. 

It was reported to the PF team that many officers left the IRC and rushed to the shootout. This created 

uncertainty as to the completion of some tasks at the IRC and contributed to an already less-than-stable 

situation at the IRC and added to the chaos at the shootout scene. 

5.11 Supervisors must anticipate the likelihood of unnecessary self-deployment and make efforts to discourage and restrict officer response. 

Tactical teams responding to the shootout were slowed by the overwhelming response of officers to the 

scene. 

5.12 Agencies must continually plan and evaluate ingress and egress routes during critical incidents. 

An incident safety officer should be designated as quickly as possible and pay particular attention to the 

access or egress of emergency vehicles. Ambulance and medical transport should be given a high priority 

task for police and fire incident command. 

Officers parking cars across all accessible lanes continues to be problematic at critical incidents. This 

issue slows or even inhibits the ability for emergency vehicles to get close enough to the incident location to recover and transport victims or provide additional resources. This problem has been noted in a 

number of critical incident reviews, including the Dorner report, the report of the Aurora, Colorado, 

movie theater shootings, the Stockton Heist report, and the Navy Yard shooter report.

97 

In the San Bernardino response, as the number of law enforcement officers responding grew so did 

traffic congestion caused by officers abandoning their vehicles in the roadway without consideration 

of the effects on the need for ingress or egress. This same problem occurred later in the response to 

the shootout. 

97 Aurora Century 16 Theater Shooting: After Action Report for the City of Aurora (Arlington, VA: TriData Division, 

2014), 

https://www.courts.state.co.us/Media/Opinion_Docs/14CV31595%20After%20Action%20Review%20Report%20R 

edacted.pdf; Rick Braziel, Devon Bell, and George Watson, A Heist Gone Bad: A Police Foundation Critical Incident 

Review of the Stockton Police Response to the Bank of the West Robbery and Hostage Taking (Washington, DC: 

Police Foundation, 2015), http://www.policefoundation.org/wp-content/uploads/2015/08/A-Heist-Gone-BadCritical-Incident-Review.pdf; After Action Report Washington Navy Yard September 16, 2013: Internal Review of 

the Metropolitan Police Department Washington, D.C. (Washington, DC: Metropolitan Police Department, 2014), 

http://www.policefoundation.org/wp-content/uploads/2015/05/Washington-Navy-Yard-After-Action-Report.pdf; 

Police Under Attack (see note 1). 

5. Command and Control 65 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

6. Planning and Response
 

Several themes emerged during discussions with first responders, fire and emergency medical services 

(EMS), medical personnel, and victims regarding the response to the Inland Regional Center (IRC) shooting and the officer-involved shooting. The majority of the issues can be categorized into five critical junctures in planning for and responding to the attacks: (1) training, (2) communications, (3) building search, 

(4) trauma care, and (5) equipment. These areas provide valuable lessons in ways in which public safety 

officers can prepare and execute response to their communities in mass casualty incidents. 

Training 

Active shooter training basics 

The San Bernardino Police Department (SBPD) began its active shooter training in 2000 in the aftermath of the 1999 shooting at Columbine High School in Colorado. The training was then presented 

during in-service training between 2007 and 2012. The department is currently updating the training 

curriculum to meet California Commission on Peace Officer Standards and Training (POST) certification 

requirements. 

A review of the active shooter training outline and presentation revealed that the SBPD program was 

comprehensive and reflected best practices. The training covered the history of active shooter events, 

terrorist attacks, and other hostile events of significant impact. A review of these case studies set the 

framework for the active shooter training as well as an opportunity to discuss lessons learned from previous active shooter, terrorist, and other hostile events. The training materials describe police priorities 

when responding to active shooter or other hostile events, including the following: 

• Capture or neutralize the suspect(s) 

• Save lives in proximity of the shooter 

• Save lives & ensure safety of citizens in the area 

• Save lives & ensure safety of officers 

• Contain the suspect(s) 

• After event investigation 

67 
 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

The training addressed the need to immediately form a three- to four-officer contact team and for the 

contact team to capture or neutralize the suspect or suspects, prevent the suspects’ escape, continue 

past victims, continue past explosives, and communicate. Training drills were used so officers could 

practice team movement, the diamond formation, and entry tactics. Another area of focus was the rescue of injured civilians and officers. Officers were also advised that active shooter or other hostile events 

would be difficult venues in which to operate because of environmental factors, confusion, and victims’ 

injuries and pleas for help. 

It is clear that officers followed the lessons learned through in-service training during their response to 

the December 2 attacks. The first officers quickly formed a contact team and entered the IRC with the 

intention of capturing or neutralizing the shooters. They entered an extremely difficult operating environment with the fire alarm sounding, water gushing from a broken fire suppression line, smoke, the 

smell of gunpowder, and seriously injured victims begging for help. Despite these issues the contact 

team continued to follow their training, pursuing the goal of capturing or neutralizing the shooters. 

The in-service training indicated that officers should equip themselves with ballistic helmets, vests, 

safety glasses, knee pads, and shoulder weapons. Some members of the initial contact team did not 

have vests or ballistic helments with them, and only one officer had a shotgun. A number of SBPD officers reported that they were ill-equipped to respond to this incident as well as hostile events more generally; some believe this is because of budget constraints. 

It should be noted that recent active shooter training had not addressed the transition from an active 

shooter or barricaded suspect event to a mass casualty incident. In addition, although the training did 

discuss victim rescue, it did not fully explore the role of a tactical rapid response or rescue team. Finally, 

the training did not discuss tactical emergency medical or trauma care. It should be noted that SBPD 

officers are not assigned personal tactical medical or trauma kits, but every unit has a trauma kit in the 

vehicle. 

Active shooter training and the San Bernardino response 

During interviews with the Police Foundation (PF) team, multiple members of the SBPD, San Bernardino County Sheriff’s Department (SBCSD), and Inland Valley Regional special weapons and tactics 

(SWAT) (IVS) teams commented on the value of previous interagency active shooter training. One officer 

remarked, “I just jumped into the formation with the SWAT guys, it was seamless.” Another officer 

commented, “regional and realistic training was invaluable. Training came into play tenfold. We didn’t 

have to think about how we should do it—we just did it.” 

The active shooter training that first responders received prior to the IRC shooting directly contributed 

to their ability to perform under the extreme conditions posed in this case. For example, the first officer on scene, an administrative lieutenant, immediately requested three additional officers; during his 

active shooter training, he had been taught the entry team should consist of four officers if possible, 

which prompted his request for three additional officers. 

68 Bringing Calm to Chaos: The San Bernardino Public Safety Response 
6. Planning and Response 69 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

Active shooter training allowed the four initial officers to form up and enter the building to search for 

the shooter or shooters with minimal discussion of roles and responsibilities. While none of the original 

entry team members—the lieutenant, a motor officer, a patrol officer, and a detective—had ever 

trained together, they “gelled” immediately. Despite the fact that the shooting scene was extremely 

difficult because of the size of the IRC, the number of victims, and their injuries and pleas for help, the 

entry team pushed through the conference room and continued to search for the shooters as trained. 

One of the officers stated that “the [victims’] wounds were devastating” and that he and his colleagues 

“had never seen bodies torn up so badly.” Although the initial entry teams were trained to find and neutralize the shooters, many of them said that the hardest thing was moving past victims begging for help. 

The SBPD’s SWAT team was conducting active shooter training at the time of the incident. Upon hearing 

of the shooting incident on their radios, the team deployed quickly to the IRC with their equipment, 

which provided a strong tactical presence at the scene. The SBPD SWAT team’s commanding officer had 

recently attended Advanced Law Enforcement Rapid Response Training (ALERRT) at the ALERRT Center 

at Texas State University–San Marcos and advised that it was invaluable to the SWAT team’s response as 

well as in establishing tactical command. 

Regional and realistic training was invaluable. Training came 

into play tenfold. We didn’t have to think about how we 

should do it—we just did it. 

Active shooter training for civilians 

Responding police officers and victims (specifically those employed at the IRC) commented on the 

impact of the civilian active shooter training that had been provided by the SBPD prior to the incident, 

especially the principles of “run, hide, fight.” Training materials for the public on surviving an active 

shooter event have been produced, including a video produced by the U.S. Department of Homeland Security entitled “Run. Hide. Fight. Surviving an Active Shooter Event.”98 Police officers and deputies noted that in many instances, personnel quickly fled the conference room and the buildings upon 

recognizing the threat or hearing gunshots. Others barricaded themselves or hid in offices, conference rooms, or bathrooms. Victims acknowledged that they used the skills they had learned during 

the training. As previously noted, some of the shooting victims acknowledged that they survived the 

attack because they had attended active shooter training in the very conference room in which the 

attack occurred. 

98 Ready Houston, “RUN. HIDE. FIGHT. Surviving an Active Shooter Event—English,” YouTube, July 23, 2012, 

https://www.youtube.com/watch?v=5VcSwejU2D0; Office of Partner Engagement, “Video: Run. Hide. Fight. 

Surviving an Active Shooter Event,” Federal Bureau of Investigation, accessed June 22, 2016, 

https://www.fbi.gov/about-us/office-of-partner-engagement/active-shooter-incidents/run-hide-fight-video. 
 

 

 

 

 

 

 

 

 

 

 

Many of the victims and law enforcement officers advised that active shooter training should not be a 

surprise. In fact, some first responders initially believed the shooting was a training event, and many of 

the victims believed the shooters were role players in a training exercise, which delayed their reactions 

to the real active shooter. 

ALERRT Training 

In 2002, Texas State University, the San Marcos (Texas) Police Department, and the 

Hays County (Texas) Sheriff’s Office created the Advanced Law Enforcement Rapid 

Response Training Center (ALERRT) at the university to address the need for active 

shooter response training for first responders. Developed after the 1999 tragedy at 

Columbine High School in Colorado, the ALERRT curriculum has become a national 

standard in active shooter response training. In 2013, the Federal Bureau of 

Investigation partnered with the ALERRT Center and named ALERRT its standard for 

active shooter response training. 

With federal and state grant funding, ALERRT has trained more than 80,000 law 

enforcement officers in dynamic, force-on-force scenario-based training in 49 states, 

Puerto Rico, and the District of Columbia. ALERRT delivers training on site in cities 

around the country and offers advanced active shooter response training at a 

multimillion-dollar training facility in San Marcos. The ALERRT Center offers nine 

grant funded first responder courses, which include trainings on different levels of 

active shooter terrorism response tactics, breaching a crisis site, operating in lowlight conditions, responding to an open-air active shooting, and responding to violent 

encounters while wearing plain clothes, as well as train-the-trainer courses for law 

enforcement officers to learn to teach fellow officers and civilians.

_______________________ 

Source: “The National Standard,” ALERRT, accessed June 22, 2016, http://alerrt.org/page/about. 

Key training themes 

Almost all first responders commented on the strong smell of gunpowder, the overwhelming noise of 

the fire alarm, and the fact that water was pouring out of a ruptured fire suppression supply line in the 

ceiling. They also commented on the physical and mental stress brought on by the extensive process of 

forcing doors open, confronting terrified and wounded victims, and searching three large buildings. As a 

result, law enforcement, fire, and EMS personnel emphasized the need for realistic physically and mentally challenging training. 

70 Bringing Calm to Chaos: The San Bernardino Public Safety Response 
 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

Law enforcement, fire, and EMS personnel emphasized the need for active shooter training that did 

not end at the point at which the threat was neutralized but rather continued to consider victim extrication, triage, and treatment. The coroner’s office recommended that its personnel participate in all 

aspects of training exercises and recommended that exercises consider the management of fatalities 

and post-incident investigations. All of the public safety officials interviewed stressed the importance 

of interagency training to build relationships, an understanding of operating protocols, and communication capabilities. 

Communications 

A strong sense of urgency enveloped the SBPD communications center as the first 911 calls were 

received and the initial police units were dispatched. As the volume of 911 calls and law enforcement 

activity increased, so did the load on the computer-aided dispatch (CAD) system. Dispatchers reported a 

noticeable lag in system responsiveness as the event grew, making their jobs more difficult. 

Likewise, as the number of law enforcement personnel grew so did the volume of police radio traffic, 

thereby limiting the availability of radio broadcast time. Also complicating the flow of information was 

the number of radio channels being used. Some officers switched to SBPD frequencies while others 

decided to stay on the frequencies of their own agencies. Many law enforcement responders reported 

difficulty in determining the best radio channel to monitor to get the most accurate information about 

the situation. Officers also reported radio communication problems inside the building, which caused 

them to use cell phones as a way to report information or request additional resources. 

Another communication issue encountered was that narcotics officers conducting covert surveillance 

did not feel comfortable using unencrypted communications to notify other relevant jurisdictions that 

they were doing so in their own jurisdiction. Officers were concerned that unencrypted channels could 

be monitored by civilians, the media, and possibly the suspects. The officers instead used their personal 

cell phones and push-to-talk capabilities and did not notify the police departments in whose jurisdictions 

they were operating. This meant that the police departments in those jurisdictions did not know that 

other law enforcement organizations were conducting surveillance in their area, which could have 

caused dangerous situations. 

Nationwide, during critical events such as active shooter events, public voice, video, and data networks 

may become overwhelmed, causing them to run slowly or to crash. Currently, public safety agencies 

(police, fire, and EMS) do not have dedicated space on the national network, nor do they receive priority 

in the event of a critical incident. If volume overwhelms local or regional networks causing them to slow 

or crash, public safety communications can be silenced. The First Responder Network Authority (First 

6. Planning and Response 71 
 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

Net), created by the Middle Class Tax Relief and Job Creation Act of 2012,99 will be the first nationwide, 

high speed broadband network for voice, video, and data dedicated to public safety. Once implemented, 

it will avoid public use space on the public broadband network, which will keep public safety communications functioning.100 

99 Middle Class Tax Relief and Job Creation Act of 2012, Pub.L. No. 112–96 (2012). 

100 First Responder Network Authority, “About FirstNet,” U.S. Department of Commerce, accessed June 22, 2016, 

http://www.firstnet.gov/about. 

72 Bringing Calm to Chaos: The San Bernardino Public Safety Response 

Building search 

As the officers searched each of the three IRC buildings, they encountered numerous locked doors and 

discovered that employees had barricaded themselves in locked offices, meeting spaces, and bathrooms. This slowed the search process and their ability to gain entry into locked rooms and hallways as 

well as delaying their ability to rescue barricaded employees. Law enforcement responders involved in 

the search of the IRC complex reported the need for a standardized system to identify and mark areas 

that had or had not been searched and were or were not secured. In addition, employees had been 

trained to barricade themselves as part of active shooter training. Employees were also instructed not to 

reveal themselves until they were convinced rescuers were actually law enforcement. With the shooters 

dressed similarly to tactical law enforcement personnel, victims and witnesses were apprehensive to 

leave their hiding spots. Other victims ran to law enforcement personnel, requiring weapons discipline 

and the ability to calm and organize victims to facilitate the extraction process. 

One tactic used by quick-thinking responders was to grab electronic keycards and office keys from 

employees as they exited the building. This proved helpful, as the keycards had varying levels of permissions to enter different rooms. Ultimately, many doors required breaching—some of which were heavy 

fireproof doors that slowed down the process and fatigued search team members. 

Trauma care 

During interviews, several law enforcement officers commented that they were not adequately trained 

or equipped to provide emergency medical care to IRC shooting victims or wounded colleagues. For 

example, members of San Bernardino County Probation, with the assistance of other law enforcement 

and fire personnel, led the extrication of victims from the IRC. As one probation officer remarked, “I 

geared up and tried to give first aid, but our [first aid] kits were insufficient to treat the wounds.” 
6. Planning and Response 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

Law enforcement agencies nationwide provide basic trauma care and equipment for their officers. In 

October 2013, the International Association of Chiefs of Police (IACP) adopted a resolution at its annual 

conference in Philadelphia recommending 

“that every law enforcement officer should receive tactical emergency medical 

training including critical core skills of early, life-threatening hemorrhage control 

and rapid evacuation of mass casualty victims to a casualty collection point. Tactical 

emergency medical skills are critical life-saving interventions in the officer-down 

situation, whether as officer applied self-aid or aid given to a fellow officer, or to 

victims of a mass casualty situation such as an active shooter or bombing event.”101 

This recommendation was repeated in the Final Report of the President’s Task Force on 21st Century 

Policing, which states, “Every law enforcement officer should be provided with individual tactical first 

aid kits and training.” 102 It goes on to state, “This would be a national adoption of the Hartford Consensus, which calls for agencies to adopt hemorrhage control as a core law enforcement skill and to integrate rescue/emergency medical services personnel into community-wide active shooter preparedness 

and training.”103 

While the primary goal of tactical emergency medical training is to assist wounded officers, the benefits of such training and equipment were demonstrated on January 8, 2011, in Tucson, Arizona, in which 

Congresswoman Gabrielle Giffords and several other people were shot. Lives were probably saved 

because responding Pima County Sheriffs’ Department deputies had tactical medical kits and training, 

which they used to treat some of the gunshot wounds. Following the Aurora, Colorado, movie theater 

shooting, tactical medical training and tactical medical kits were developed and distributed to Aurora 

police officers.104 Other departments nationwide provide basic trauma care training and tactical emergency medical kits for their officers. For example, the Rochester (Minnesota) Police Department has 

developed an eight-hour basic tactical casualty care course modeled on the military’s combat lifesavers 

curriculum, which provides trauma equipment for its officers.105 

101 Police Physicians Section, “Tactical Emergency Medical Training for Law Enforcement Personnel: Adopted at the 

120th Annual Conference, Philadelphia, Pennsylvania, October 23, 2013,” International Association of Chiefs of 

Police, accessed June 22, 2016, http://www.iacp.org/ViewResult?SearchID=2310. 

102 President’s Task Force on 21st Century Policing, Final Report (see note 4), 66. 

103 Ibid. 

104 Aurora Century 16 Theater Shooting (see note 97), xiv. 

105 Matthew D. Sztajnkrycer, Roger L. Peterson and Sarah L. Clayton, “Medical Tactics for Law Enforcement: 

Development of the Rochester (Minnesota) Police Department Basic Tactical Casualty Care (BTCC) Course,” The 

Police Chief 77, no. 12 (December 2010), 92–101, 

http://www.policechiefmagazine.org/magazine/index.cfm?fuseaction=display_arch&article_id=2271&issue_id=12 

2010. 

73 
 

 

 

 

 

 

Law enforcement and fire personnel held significant discussion regarding the best approach for victim 

triage, extrication, and treatment during active shooter and hostile events. In fact, a fire medic assigned 

to the SBPD SWAT team triaged victims inside the IRC, which significantly enhanced victim extrication 

and survival. The Rancho Cucamonga Fire Department’s Rescue Task Force was deployed to the IRC and 

was on standby throughout the incident. 

Safety Zones and Perimeters Defined 

Hot zone. The area where a direct and immediate threat exists. A direct and 

immediate threat is very dynamic and is determined by the complexity and 

circumstances of the incident. Examples of direct and immediate threats are an 

active shooter, a barricaded suspect, a hostage situation, a high-risk warrant service, 

and possible terrorist acts. This could also be classified as the “inner perimeter” by 

law enforcement, an area within the range of active gunfire or secondary devices 

immediately dangerous to life and health (IDLH). Law enforcement should also 

consider the area to be IDLH if they can visualize the shooter or determine a threat. 

Warm zone. The area where a potential threat exists, but the threat is not direct or 

immediate. An example of this is an unknown location of suspects in a given area 

already cleared. Fire department resources may be requested to enter into warm 

zones, but this should only be done with force protection, with cover and 

concealment, or in accordance with local fire department policies. These instances 

could be used for rapid extraction of multiple victims or officers down who need 

immediate assistance. Prior to entering into a warm zone, a risk-versus-gain analysis 

should be completed. Law enforcement could also refer to the warm zone as part of 

the inner perimeter. 

Cold zone. The area where no significant danger or threat can be reasonably 

anticipated. This could be achieved by distance, geographic location, or inaccessible 

areas from the incident. The cold zone is the location for staging of resources, the 

incident command post, and treatment and transportation of patients. This area 

could also be classified “outer perimeter” by law enforcement. 

_______________________ 

Source: FIRESCOPE, Emergency Response to Tactical Law Enforcement Incidents (Sacramento, CA:

Firefighting Resources of California Organized for Potential Emergencies, 2015,)

http://www.firescope.org/meetings/bod/2015/bod_meeting3/documents/ics%20701.pd f. 

74 Bringing Calm to Chaos: The San Bernardino Public Safety Response 
 

 

 

 

 

 

 

 

The PF team reviewed policies and procedures developed by the Rancho Cucamonga Fire Department in 

collaboration with the SBCSD, which is considered a national model, as well as national best practices. 

The InterAgency Board, for example, recommends that municipalities “adopt the rescue task force concept as a multidisciplinary team that includes law enforcement protection as a method of quickly getting 

fire [and] EMS personnel to victims in an active shooter [or other] hostile event.”106 The Rescue Task 

Force concept has also received support from the National Tactical Officers Association (NTOA),

107 the 

International Association of Fire Fighters,

108 and the U.S. Fire Administration.109 

Trauma Center Response 

Upon receiving notice of the Inland Regional Center active shooter incident , one of 

the region’s primary trauma centers reacted quickly by immediately setting up 10

trauma teams to treat incoming victims. The trauma teams were aided by medical 

reside nts present for a prearranged training day. This particular emergency room 

received six pat ients. The emergency room doctor interviewed by the Police 

Foundation team advised that “the people in the field did a very good job of triaging 

the victims as well as ensuring that they were unarmed.” T he doctor furt her shared 

that the hospital co nducts an annual EMS day with regional law enforcement, fire, 

and EMS de partments to train for a mass casualty incident . The t rauma center also 

conduct s quarterly int ernal mass casualty drills. 

106 Improving Active Shooter/Hostile Event Response (see note 78), 16. 

107 “The National Tactical Officers Association recommends that special operations teams (SWAT, SERT [special 

emergency response team], etc.) include properly trained tactical emergency medical providers. The TEMS (tactical 

emergency medical support) providers are capable of developing medical threat assessments, implementing risk 

reduction strategies, providing logistical support, coordinating operations with local emergency medical services 

(EMS), and rendering immediate medical care within the tactical environment of a law enforcement operation.” 

Kevin Gerold, “TEMS Position Statement: Inclusion of Tactical Emergency Medical Support (TEMS) in Tactical Law 

Enforcement Operations,” National Tactical Officers Association, accessed June 22, 2016, 

http://ntoa.org/sections/tems/tems-position-statement/. 

108 IAFF Position Statement: Active Shooter Events (Washington, DC: International Association of Fire Fighters, n.d.), 

http://www.acphd.org/media/372823/iaff_active_shooter_position_statement.pdf. 

109 U.S. Fire Administration, Fire/Emergency Medical Services Department Operational Considerations and Guide 

(see note 94). 

6. Planning and Response 75 
 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

Fire and EMS personnel also credited their mass casualty training with the ability to quickly establish a 

casualty collection, triage, and treatment area. The mass casualty training allowed them to quickly coordinate with area hospitals through ReadyNet (the region’s emergency room notification system) and 

direct calls to trauma centers. In fact, all injured victims were cleared from the casualty collection point 

located in the San Bernardino public golf course in a little more than 14 minutes. 

Planning and preparation lessons learned 

Law enforcement leaders and personnel in San Bernardino recognized the need to plan and train for a 

critical incident. Following the 2013 shootings by Christopher Dorner in Southern California,110 San Bernardino law enforcement leadership took lessons learned and began an ongoing process of training personnel to better respond to an active shooter. 

Training 

Regional training 

6.1 Because initial responders to a critical incident may be from a variety of agencies, regional training 

improves performance in a crisis response and should include all disciplines and levels of first responders. 

Fire, EMS, and other potential first responders should be included in in-service active shooter training as 

appropriate. 

The San Bernardino City Unified School District Police, in conjunction with other city departments, 

conducted an active shooter drill in 2013, which tested the core capabilities of unified command, victim extraction and triage, and medical surge at area hospitals. Other law enforcement agencies and fire 

departments discussed regional active shooter drills that had been conducted as well as the benefits of 

interdisciplinary cross training. Officers previously unknown to one another worked effectively as the 

initial responders because of these regional training efforts. 

6.2 In-service training, regardless of the topic, should be updated on an annual basis and meet federal, 

state, and other appropriate certification standards. 

It is important that in-service training be updated to ensure that response protocols taught to officers 

include the most updated standards and best practices. 

110 Police Under Attack (see note 1). 

76 Bringing Calm to Chaos: The San Bernardino Public Safety Response 
 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

Train for high stress situations 

6.3 The ability to understand and apply response strategies in a high-stress environment improves performance. Training should attempt to create as much sensory deprivation or stimulus as possible to 

simulate real-world scenarios. 

First responders entering the building encountered a barrage of stimuli that accosted all of their senses. 

They saw dead and wounded victims, heard screaming and moaning from victims, smelled the distinct 

odor of gunpowder, felt water pouring from the fire sprinkler system, experienced movement as injured 

and uninjured victims ran from the building, and heard and saw the wailing of an extremely loud fire 

alarm and strobe light system, all while experiencing a heightened level of fear because of the unknown 

status of the shooters and the possibility of other threats. This level of chaos can cause a high stress situation that affects officers’ abilities to apply response strategies learned during training. This should be 

considered and perhaps even simulated during training. 

6.4 First responders should be familiar with critical infrastructure as well as facilities that regularly 

bring large numbers of people together. Consideration should be given to reducing or eliminating environmental stressors if possible. Sound, darkness, and other environmental stressors can make it difficult 

to find and identify suspects and may hinder evacuations as well as search and rescue efforts. 

Train for tactical emergency medical care 

6.5 Law enforcement agencies should train all officers in tactical emergency medical care. 

Both the IACP and the Final Report of the President’s Task Force on 21st Century Policing recommend 

this as a standard part of training for all law enforcement officers. 

Train to transition from active shooter to barricaded suspect 

6.6 Active shooter training should include transition from a dynamic active shooter situation (a situation that is evolving very rapidly consistent with the suspect's actions) to a static situation (a situation 

that is not evolving or in motion because the suspect[s] is contained, has escaped, or is incapacitated). 

Training should recognize that active shooter incidents may evolve from dynamic to static situations 

and possibly back to dynamic or mass casualty situations requiring transitions over the course of the 

police response.111 

111 “Response to Active Shooters,” National Tactical Officers Association, accessed July 14, 2016, 

http://www.muni.ri.net./middletown/vendor/ag1.ppt. 

6. Planning and Response 77 
 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

In the San Bernardino attack, the shooting had stopped before the first contact team arrived at the IRC. 

However, the officers did not know this, and they actively searched for the shooters until they were 

entirely sure there were no active shooters still in the IRC. Although not the appropriate tactic in the IRC 

active shooter incident, some first responders interviewed remarked that they were so intent on finding 

the shooters that they did not transition from employing dynamic situation tactics to employing static 

situation tactics. Accordingly, it is recommended that general active shooter training include a block 

about transitioning tactics from those addressing a dynamic situation in which the suspect or suspects 

are causing immediate death or serious bodily injury to those used in a static incident in which the suspect or suspects might be barricaded in another area of the building. 

Follow training through to notification of families 

6.7 Training exercises should continue past the point where the threat no longer exists and extend to 

the notification of victims’ families by the medical examiner or coroner. 

Too often, training events stop after the shooters are located and the threat eliminated. This leaves first 

responders with a lack of knowledge and appreciation for how the entire response system functions and 

how their actions influence other steps of the process. Additional thought should be given to including 

clergy, mental health or crisis counselors, and victim advocates in training exercises as well as planning 

for family reunification and notification, victim interviews, and staging areas. 

Prepare for secondary devices 

6.8 Training should include secondary device identification, notification, and isolation. 

As previously indicated, the use of secondary devices is a common practice among terrorists operating 

in various areas of the world. The primary intent of a secondary device is to kill or injure first responders 

during the post-incident investigation, at the command post, triage area, and so on. In this incident, it 

was believed that secondary devices were left in the conference room for the sole purpose of killing or 

injuring first responders once it was remotely detonated. 

Civilian active shooter training 

6.9 Civilian and private sector training for an active shooter event can save lives. Inform the public of 

appropriate measures to take if they are involved in an active shooter or other hostile event, and provide 

a general overview of the police response. 

During the shooting at the IRC, employees within the complex followed training directives and found 

secure locations to barricade themselves. First responders should work with public, private, and not-forprofit employers to establish protocols and training for non–law enforcement personnel to prepare 

them to experience and survive an active shooter or other hostile event. 

78 Bringing Calm to Chaos: The San Bernardino Public Safety Response 
 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

The Federal Bureau of Investigation (FBI), the Houston (Texas) Police Department, the U.S. Department 

of Homeland Security, and a number of other departments have put out free instructional materials 

including videos, trainings, and literature for the public on what to do in an active shooter incident.112 

The key guidance to offer is as follows: 

• Run, if you can. 

• If you can’t run, hide. 

• If you can neither run nor hide, fight the shooter(s), preferably in concert with others. 

Communications 

“An essential need during any emergency is the ability of an agency to communicate both internally and 

with other agencies. With this requirement in mind, the problem of communications should be a priority 

in mutual aid planning before an incident occurs.”113 

Dispatch systems 

6.10 Communications centers should hold regular interdepartment interoperability communication 

drills with regional public safety agencies. Human and equipment communication issues should be identified and remedied during communication drills and joint exercises. 

6.11 Dispatch centers should be included in incident command system (ICS) training, which should 

include testing public safety proficiency in using radio and other communication systems. 

6.12 Because dispatch systems can quickly become overwhelmed in a mass casualty, active shooter, or 

other critical incident, agencies should develop a tactical dispatcher system that provides a dedicated 

dispatcher responsible for the operational needs of the incident and tactical commander. 

112 Ready Houston, “Regional Disaster Preparedness,” City of Houston Office of Public Safety, accessed June 22, 

2016, http://www.readyhoustontx.gov/videos.html; Ready Houston, “RUN. HIDE. FIGHT. Surviving an Active 

Shooter Event—English,” YouTube, July 23, 2012, https://www.youtube.com/watch?v=5VcSwejU2D0; Office of 

Partner Engagement, “Video: Run. Hide. Fight. Surviving an Active Shooter Event,” Federal Bureau of Investigation, 

accessed June 22, 2016, https://www.fbi.gov/about-us/office-of-partner-engagement/active-shooterincidents/run-hide-fight-video; “Active Shooter Preparedness,” U.S. Department of Homeland Security, last 

modified June 16, 2016, https://www.dhs.gov/active-shooter-preparedness. 

113 Dacia Young and Dennis Beene, Law Enforcement Mutual Aid Plan (Mather, CA: Governor’s Office of Emergency 

Services, 2016), 21, http://www.caloes.ca.gov/LawEnforcementSite/Documents/1Blue%20Book.pdf. 

6. Planning and Response 79 
 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

6.13 Develop a system and protocols for diverting nonemergency calls elsewhere as well as establishing 

protocols to handle calls from family, friends, and media. 

Area communications centers became inundated with phone calls many from on- and off-duty personnel asking if they were needed, family and friends of employees at the IRC, and the media. 

6.14 During large-scale multiagency events, dispatch personnel should be colocated to facilitate information exchange and resource coordination and to compliment ICS. 

6.15 CAD systems should be load tested to ensure the systems can handle a significant event lasting a 

long period of time. 

6.16 Training exercises should simulate a system slowdown or shutdown during a crisis and describe 

alternative communication strategies and protocols. 

Radio communication 

6.17 Agencies should identify facilities within their communities that pose radio transmission and 

reception difficulties and use those facilities to train personnel and identify ways to mitigate poor communication so they are prepared should an incident occur. 

Responding officers were not able to use their radios inside the IRC because of poor transmission and 

reception. Some cities require the installation of public safety repeaters in new construction and mandate retrofitting existing commercial and residential buildings to address building construction issues 

that negatively impact radio use. 

FirstNet 

The First Responde r Authority Network (FirstNet) was created under federal law in 

2012 to “build, operate and maintain t he first high-spee d, nationwide wire less 

broadband network de dicate d to public safety.” FirstNet will provide a resilient and 

redundant network that can be shared by police officers, firefighters, paramedics, 

and ot her public safety and support pe rsonnel to ensure interoperability duri ng the 

response to a critical incide nt. 

_______________________ 

Source: First Responder Network Authority, “Guiding Principles,” U.S. Department of Commerce, 

accessed June 22, 2016, http://www.firstnet.gov/about/guiding-principles. FirstNet was also the 

focal point of recommendation 3.7 of the Final Report of the President’s Task Force on 21st 

Century Policing (see note 4). 

80 Bringing Calm to Chaos: The San Bernardino Public Safety Response 
 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

6.18 Agencies must reinforce radio discipline. Merely increasing radio capacity alone does not reduce 

the volume nor does it establish a priority of communication. It is an officer’s responsibility based upon 

training and agency policy to differentiate between critical radio communication and less critical communication that does not need to be broadcast. 

Police radio traffic became overwhelmed, and officers most in need of a clear channel were not able to 

obtain it because the response was so large. 

6.19 Additional consideration should be given to merged radio systems and protocols between law 

enforcement, fire, and EMS. 

6.20 The ability to communicate using encrypted channels improves communication without jeopardizing officer and community safety. 

Officers responsible for covert surveillance of potential suspect locations expressed concern that discussing locations or tactics via unencrypted radio systems put themselves and the public at risk. The 

officers instead used private network chats (push-to-talk), which resulted in a lack of information available to supervisors and other field personnel. According to one article, “San Bernardino police Lt. Michael 

Madden, who was the first to arrive at the scene of the mass shooting at the Inland Regional Center, 

said one of the most troubling things about that day was that police radio communications were broadcast live, in real time, nationwide—on YouTube and other network systems—for all to hear, including 

potential suspects.” 114 

Implementation of encrypted communications, however, can be controversial and should not be 

undertaken without careful consideration. It is important for public safety departments to gauge their 

communities’ questions or concerns about the use of such technology. In addition, it is critical that 

departments that do use encrypted communications develop and implement strictly followed policies 

and protocols. With encryption, agencies should consider the necessity of requiring supervisory approval 

prior to use of the channel as well as monitoring by supervisory personnel. Unless approved by an incident commander, encryption should not be used during an operational or tactical event as doing so may 

create an officer safety issue for those not subscribed to the encrypted channel. 

6.21 Ensure that communications extend to the appropriate public safety organizations even if the 

technology in use does not automatically do so. 

Critical incidents often extend into varying jurisdictions, and it is important that agencies responsible for 

public safety in those jurisdictions be informed about the activities that are taking place there. 

114 Joe Nelson, “Assemblyman Hosts Hearing on Lessons Learned from Dec. 2 San Bernardino Terror Attack,” San 

Bernardino Sun, March 18, 2016, http://www.sbsun.com/general-news/20160318/assemblyman-hosts-hearingon-lessons-learned-from-dec-2-san-bernardino-terror-attack. 

6. Planning and Response 81 
 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

Building search 

6.22 Pre-incident planning should include timely access to building diagrams, particularly critical 

infrastructure and plans of buildings where large numbers of persons gather on a regular basis. 

6.23 Regions should adopt a standardized marking system, similar to the International Search and Rescue Advisory Group marking system,

115 for easy identification of areas searched, cleared, and secured by 

law enforcement personnel. 

Entry teams into the IRC reported many areas that were searched more than once because searchers 

were not certain whether other teams had previously cleared the area. Officers reported a lack of a system to distinguish areas that had been searched and secured. 

6.24 Law enforcement agencies should establish training and protocols for the use of rapid entry systems used by fire and EMS providers so that the need to breach locked or barricaded doors is reduced. 

6.25 States should establish a resource typing system, similar to the system used by the fire service,

116 

to categorize and track available resources that may be required to respond to a critical incident. 

115 International Search and Rescue Advisory Group, “INSARAG Guidelines,” United Nations Office for the 

Coordination of Humanitarian Affairs, last modified February 11, 2015, 

http://www.insarag.org/en/methodology/guidelines.html. 

116 Governor’s Office of Emergency Services, “Team Typing Information,” State of California, accessed June 22, 

2016, http://www.caloes.ca.gov/cal-oes-divisions/fire-rescue/hazardous-materials/team-typing-information. 

Trauma care 

6.26 Public safety agencies should consider how they will deploy emergency medical responders in 

active shooter or other hostile events to ensure victim triage, extrication, and treatment. 

6.27 To reduce the amount of time it takes for victims to receive medical care regions should establish 

medical tactical teams designed to work in a “warm zone,” allowing victims to be moved more quickly to 

a mass casualty triage area. 

82 Bringing Calm to Chaos: The San Bernardino Public Safety Response 
 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

Equipment 

6.28 Agencies should ensure adequate protective gear is issued to personnel that may respond to an 

active shooter incident. Equipment should include active shooter armor kits (ballistic helmets and ballistic 

vests with ceramic plates) that afford greater protection from high-powered semi- and fully automatic 

weapons and ammunition. 

In this incident, members of the initial contact teams would have been inadequately protected had they 

confronted the terrorists at the IRC, where they were armed with .223 caliber assault rifles. 

6.29 Law enforcement agencies should equip officers with personal tactical emergency medical kits. 

These medical kits are designed to save lives and will allow officers to respond to victims’ loss of blood 

quickly and efficiently. As part of the testimony provided to the President’s Task Force on 21st Century 

Policing, Dr. Alexander Eastman noted that “tactical first aid kits would significantly reduce the loss of 

both officer and civilian lives due to blood loss.”117 

6.30 If equipment is incorporated as an integral part of training, officers should have the equipment 

issued and available to them. 

6.31 Response protocols should include positioning heavy fire response vehicles as shields from secondary devices and active shooters. 

As part of preparing for the threat of secondary devices and continued active shooter activity, heavy 

vehicles should be positioned to shield victims and responders from danger. 

117 President’s Task Force on 21st Century Policing, Final Report (see note 4), 66. 

6. Planning and Response 83 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

7. Investigations
 

The law enforcement investigation of the terrorist attack at the Inland Regional Center (IRC) and 

shootout that followed represents a complicated series of events that highlights the varying interests 

and objectives of the multiple agencies involved in the investigation phase. In an ideal scenario, these 

agencies would have the opportunity to negotiate interests and objectives before commencing operations or immediately afterward, but the constantly evolving nature of this situation required agencies to 

confront issues as they unfolded. As the investigation progressed and federal agencies began to assume 

more responsibilities, differences in investigative techniques and protocols, short-term versus long-term 

goals, and investigative experience created tension. The goal of this section is to highlight promising 

practices and inform agencies of some of the investigative concerns to consider in planning for similar 

events. 

Promising practices 

The terrorist attack at the IRC set in motion a series of events that continued to unfold rapidly. Immediately following the shooting at the IRC, several nearby agencies quickly responded to the scene to assist the San Bernardino Police Department (SBPD) with investigative needs, including the San Bernardino 

County Sheriff’s Department (SBCSD), member agencies of the Joint Terrorism Task Force,

118 the Federal Bureau of Investigation (FBI), and the Bureau of Alcohol, Tobacco, Firearms, and Explosives (ATF). 

While this large number of involved agencies could have caused confusion and duplicative efforts, the 

positive pre-existing relationships among San Bernardino law enforcement leaders allowed decisions on 

the division of work and areas of responsibility to be made quickly. As the agency with primary jurisdiction over crimes committed in the city of San Bernardino, the initial responsibility for conducting the 

investigation of the IRC fell to the SBPD. Given the severity of the incident, the SBCSD offered to assist in 

any way necessary, including beyond their regular role as coroners and managers of the county crime 

lab. In addition, when the suspects engaged officers in a lengthy shootout that left both terrorists dead 

and two officers wounded, it was decided by leaders within the Unified Command Center (UCC) that the 

investigation at that second shooting scene would be conducted by the SBCSD. 

Cooperation between investigating agencies also extended to technology. The SBCSD offered the use 

of their 3D laser scanner to create 3D images of the IRC crime scene. This technology greatly enhances 

the accuracy of scene analysis and reconstruction. This collaboration allowed the FBI to obtain 3D data 

points that could be stored and can be analyzed remotely and indefinitely. 

118 Member organizations assigned to the JTTF at the FBI office in Riverside include the SBCSD, the SBPD, and the 

Department of Homeland Security/Homeland Security Investigations. 

85 
 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

Ultimately, once the incident was officially labeled a terrorist attack, the FBI became responsible for the 

investigation. While the diverse set of agency responsibilities could have caused myriad complications, 

the level of cooperation and collaboration among agency leadership greatly improved the overall outcome of the response and investigation. However, that does not mean that there were not challenges. 

Parallel interests 

The parallel interests of the various federal, state, and local investigators on scene during an investigation can turn into competing interests if investigators at all levels do not work together to identify 

strengths and assets, outline priorities, and develop complementary investigatory strategies. The chaotic 

and fluid nature will set a challenging scene for any investigation, making communication and coordination even more critical. 

Once the gun battle between the suspects and police was cleared, local responding agencies treated 

the scene as an officer-involved shooting where the two assailants died, undertaking standard officerinvolved shooting and homicide investigation protocol. During the investigation, several agents from 

different federal agencies arrived with specific tasks that did not fit with and could have compromised 

traditional homicide investigations. For example, one agent began examining the shooters’ .223-caliber 

rifles and 9-mm handguns. The male assailant’s rifle had been modified to attempt to make it fully 

automatic but because it was handmade and done poorly, authorities determined it was at best semiautomatic. Another agent came to collect the shooters’ electronics, consisting of a cell phone, a tablet, and 

an MP3 player. 

As mentioned in the earlier narrrative, local investigators who were in the initial stages of the officerinvolved shooting investigation found it difficult to work with federal law enforcement agents 

because of perceived competing roles and interests. Most investigators from the numerous agencies 

that responded did not have a prior working relationship with one another and did not understand one 

another’s roles and priorities, including the priority of determining whether this was in fact an act of terrorism and immediately investigating any and all terrorism leads and links. This lack of understanding 

among the different agencies led to a lack of appreciation for the sensitive nature of the work that 

needed to be performed quickly by the various agencies and the need to quickly analyze the information 

obtained at the scenes. 

In addition, the need to determine whether or not the incident was an act of terrorism created confusion among field investigators. Shortly after the initial 911 call from the IRC, local law enforcement officials believed that the events could be an act of terrorism. While this determination would shift primary 

investigative responsibility of the shootings to the FBI, UCC leaders chose to follow protocols associated 

with mass murder until the official determination was made. Therefore, the SBPD continued in the lead 

role investigating the IRC shooting and the SBCSD maintained responsibility for the officer-involved 

shooting scene on San Bernardino Avenue. However, this decision was not communicated from the UCC 

to all field investigative personnel from the FBI. 

86 Bringing Calm to Chaos: The San Bernardino Public Safety Response 
 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

The positive pre-existing relationships among San Bernardino law 

enforcement leaders allowed decisions . . . to be made quickly. 

According to local law enforcement investigators, another complicating factor arose when a change in 

FBI personnel temporarily affected collaboration and the investigation of the IRC scene. Just as crime 

scene teams of local investigators and FBI personnel had come up with joint solutions and were getting 

comfortable working together, the initial group of FBI personnel that had been deployed was replaced. 

The new group was unaware that the incident had not yet been confirmed as a terrorist attack and 

thought they were the lead investigators.119 

Differences in evidence collection techniques, crime scene processing, and technology were also complicating factors. Both the SBPD and the SBCSD have experienced homicide detectives and crime scene 

investigators and state-of-the-art technology. When added to the personnel and resources that were 

brought by the FBI and other federal agencies involved, the overload created some concerns. For 

instance, some federal investigators did not follow the SBCSD techniques and protocols for submitting 

items to the pathologist, requiring additional work by the pathologists to determine what clothing 

belonged to each suspect. 

The purpose of discussing the parallel or competing interests and priorities is not to be critical of any 

particular agency but to highlight the likelihood that some level of conflict may occur even among highly 

trained and well-intentioned professionals, especially when they have no prior relationship. The goal is 

to develop working relationships as well as an understanding of each agency’s role, skills, experience, 

and capabilities before an incident happens. Positive working relationships can clarify roles, reduce conflict and increase collaboration. 

119 It should be noted this first set of FBI personnel were FBI SWAT and bomb technicians and not the actual 

investigators and evidence collectors. Once a room or building was tactically cleared, the FBI crime scene 

investigators took over the scene. 

Victims and witnesses 

The logistics associated with the identification and interviewing of witnesses and victims were monumental. In the first few hours, local law enforcement investigators identified more than 400 victims and 

witnesses who needed to be moved from the IRC to a safe location, treated for varying levels of injuries, 

interviewed, and reunited with their families. In addition to maintaining the safety and security of the 

numerous victims and witnesses, issues related to their privacy and transportation arose during the process. Especially in an event of this size, critically assessing how the San Bernardino area agencies handled the victims and witnesses and identifying lessons learned is crucial as other agencies prepare for 

similar situations. 

7. Investigations 87 
 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

Investigators established an interview protocol that can best be described as an assembly line. Investigators first triaged the arriving witnesses to separate witnesses from victims while also identifying those 

who might have had information critical to identifying the suspects. A team of investigators then began 

the process of conducting individual interviews. Once the victims and witnesses had completed their 

interviews, pictures were taken in front of a whiteboard where the individuals’ names were written to 

assist in later identification. 

While the interviewing and documenting of witnesses and victims was conducted in an efficient way, 

many witnesses and officers expressed that several logistical issues became serious concerns. When the 

media determined that the Hernandez Center had been identified as the location where the victims and 

witnesses would be brought, they lined the path from the transport vehicles to the center. When the 

victims and witnesses arrived with law enforcement, members of the media were able to identify some 

of them by recording the name badges worn by employees and to attempt to interact with the witnesses. Some described the line into the church as similar to a “perp walk” when a suspect is walked through 

a public area, allowing the media to take photographs and video of the suspect. While this was not the 

intention of law enforcement, the experience was chilling to some of the witnesses. 

Once inside the Rock Church, complicating the task of interviewing victims and witnesses was the selfdeployment of clergy and counselors. While they were well-intentioned, many of them were not trained 

for a traumatic event such as this. This created situations where individuals who needed counseling 

were unable to get it in a timely fashion and counselors were mixed in with victims and witnesses. 

Furthermore, witnesses and victims found it difficult to notify family members and friends. Many had to 

leave their cell phones behind when they fled the IRC, while others who were fortunate to have their 

phones discovered the phones had run out of battery charge. Charging cords were supplied by those 

who had them and those with active phones provided phones for others to use, but the long waits to 

make a phone call in such a critical time created even more frustration. 

In addition, witnesses became frustrated when they had completed their interviews but learned that 

there would be a delay in being reunited with loved ones until the transport buses leaving the church 

were full. 

Investigations lessons learned 

While local law enforcement investigative personnel in San Bernardino were accustomed to working 

with regional partners during complex investigations, the influx of federal agents from various federal 

agencies outside the San Bernardino area created tension among investigative personnel. Mutual 

88 Bringing Calm to Chaos: The San Bernardino Public Safety Response 
 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

recognition of the level of expertise agencies possess, both in experience and technology, and the different missions and priorities of the various agencies is important to the successful investigation of 

crime scenes requiring large multiagency response. 

Parallel interests 

7.1 All first responder agencies must recognize that not all mass casualty incidents are crime scenes 

(for example, natural disasters are not crime scenes), but all terrorist events are. All responders to a 

potential terrorist incident should understand the importance of evidence preservation, documentation, 

and collection. 

7.2 Critical incident management is greatly enhanced when there are pre-existing relationships between leaders and field supervisors from all potential first responder agencies. 

7.3 A determination should be made in identifying agencies with the best skills and tools to perform 

investigative tasks. Jurisdictional investigative authority does not necessarily correlate with investigative 

skills, abilities, training, and equipment. 

Ideally, this determination would be made in advance of a critical incident, and the agency assigned to a 

task may not be the agency with investigative responsibility. This may be particularly true when incidents occur in areas where local law enforcement has unique experience, relationships, and assets. 

Victims andwitnesses 

7.4 Critical incident training and exercises should include an investigative component that includes 

identifying all aspects of victim and witness identification, interviewing, and reunification. 

7. Investigations 89 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

8. Community Engagement, 

Relationships, and Public Information 

In all critical incidents, law enforcement agencies face a delicate balance when it comes to informing 

the public about what is taking place versus protecting the investigation from outside influence. Law 

enforcement leaders should expect that some citizens suffer added fear as an event unfolds that it is 

part of a coordinated set of terror as experienced on September 11, 2001, in the United States and more 

recently in Paris and Brussels. 

The news media’s hunger for breaking news 24 hours a day, seven days a week can also compound law 

enforcement’s ability to manage the delivery of information. The issue is no longer managing content 

only for television and newspapers; it now includes planning for and expecting challenges from online 

media outlets. These outlets can often operate without the scrutiny and rigor of some of the traditional 

types of media organizations. Many times these outlets report incorrect facts and information, leading 

to viral rumors that spread quickly. The reaction and rhetoric that follows viral rumors can hamper first 

responders’ efforts as well as the investigation phase of an event. 

When multiple federal, state, county, and local agencies are involved in an event, there is a potential for 

conflict and confusion with each agency operating under different media guidelines. In the San Bernardino terrorist attacks at the Inland Regional Center (IRC), however, the numerous agencies were able to 

work through challenges in a cohesive manner and successfully deliver messages to the public. 

Public affairs 

Because the case was classified as a mass shooting incident for the first two days, the San Bernardino 

Police Department (SBPD) initially retained the lead on the dissemination of information. At the time of 

the attack, the SBPD had a small public affairs office consisting only of two part-time public information 

officers (PIO), one of whom was out of the office for a family emergency. This meant that the backup 

PIO had to manage independently for the first few hours of the incident. SBPD Chief Jarrod Burguan 

soon accepted San Bernardino County Sheriff John McMahon’s offer to have his public affairs unit work 

with Burguan’s PIOs. 

At the outset of the attack, Chief Burguan sent the PIO to the SBPD incident command center area 

designated for the press. Dozens of reporters had already gathered there, and the PIO was left without 

assistance for two hours. When Burguan realized that the single PIO would not be enough to manage 

the large scale incident, he tapped into the sheriff’s department for its public affairs capabilities. The San 

Bernardino County Sheriff’s Department (SBCSD) Public Affairs Unit consists 

91 
 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

of PIOs, community liaisons, labor relations specialists, and others. Three of those members—the unit’s 

lieutenant, a veteran PIO, and the social media specialist —arrived at the scene and began working with 

the SBPD PIO. 

The sheriff’s public affairs unit had already designated the incident as a level 3 event, which is the highest on its classification scale that was developed in 2013. A level 3 is defined as “any law enforcement 

incident or natural disaster that has a duration longer than 24 hours and will require the division to 

maintain operation. All personnel will be placed on a 12-hour on and 12-hour off operation until further 

notice.”120 

The social media specialist, using her department-issued iPhone (all members of the unit are issued 

smart phones), began using Twitter as a means to let the public know what was happening at the IRC. 

She posted her first tweet at 11:18 a.m., alerting the public of police activity in the area. Ensuing tweets 

informed the public about new developments throughout the day, including the officer-involved shooting with the two suspects hours later. Altogether, she tweeted 42 times on the first day with details 

about the event. Figure 3 is an example of an update to an earlier Twitter post. 

Figure 3. Tweet from SB County Sheriff’s Office 

Source: SB County Sheriff (@sbcountysheriff), “ACTIVE SHOOTER:Area of Orange Show Rd/ Waterman 

Ave near Park Center, & surrounding area remains VERY ACTIVE. AVOID!,” Twitter post, December 2, 

2015, 11:51 a.m., https://twitter.com/sbcountysheriff/status/672141064073965568. 

Chief Burguan keeps his own professional Twitter account and uses it both to promote the department 

and to provide information about incidents. He also tweeted throughout the day (examples are shown 

in figure 4 on page 93), including late that first night when there was a potential incident at a local 

warehouse facility. The tweets were picked up by the local TV news stations and helped diffuse that 

late-night event to become a nonstory. 

120 John McMahon, Emergency Action Plan: Public Affairs Division (San Bernardino, CA: San Bernardino County 

Sheriff’s Department, 2016). 

92 Bringing Calm to Chaos: The San Bernardino Public Safety Response 
 

 

 

Figure 4. Tweets from SBPD Chief Jarrod Burguan 

Source: Chief Jarrod Burguan’s Twitter page, username @SBPDChief, accessed June 21, 2016, 

https://twitter.com/SBPDChief. 

8. Community Engagement, Relationships, and Public Information 93 
 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

Contemporary law enforcement best practices recommends that “Law enforcement agencies should 

adopt model policies and best practices for technology-based community engagement that increases 

community trust and access.”121 This technology, particularly social media, can prove especially useful 

for communication in critical incidents. “During and after a disaster, it is not uncommon for traditional 

modes of communication, such as land-line telephone service and television news, to be unavailable. In 

addition, people may be displaced and therefore not have access to such devices. Social media is accessible through mobile devices, allowing people to take the information with them wherever they go. 

People may also receive these notifications via text message, a function that may be available when 

broadband and other cell phone connectivity is low.”122 

At the SBCSD’s Public Affairs Unit offices, the rest of the team was up and running. The unit’s main 

office has four 55-inch flat screen televisions that were tuned to local and cable news stations as a 

way to monitor what information was being relayed to the public. The unit also used an interactive electronic screen that is visible from all of the desks in the room. Only verified information that could be 

released to the media or public was posted there, which helped ensure that the unit put forth a consistent message. At the same time, journalists were encouraged to follow both the SBCSD and SBPD 

Twitter accounts for the newest details about the incident. This strategy reduced the number of phone 

inquiries from the press, thereby relieving staff to attend to other tasks. 

As the first day progressed, public affairs members of the SBPD, SBCSD, the Redlands Police Department, the Federal Bureau of Investigation (FBI), and the Bureau of Alcohol, Tobacco, Firearms, and 

Explosives (ATF) worked together and met regularly. Public affairs staff members were also included 

in regular command-level meetings, which, at least for the SBCSD PIO, was a departure from the usual 

experience. Staffers praised this decision, which allowed them to efficiently craft messages with command leaders that would be delivered during press conferences held several times each day. 

Details were considered, including managing how the three agencies’ leaders—Chief Burguan, Sheriff McMahon, and FBI Assistant Director David Bowdich (the FBI’s assistant director in charge of the 

Los Angeles field office)—would walk out to each press conference in the order of each speaker. All 

three leaders felt it was important to show the public the unified front of multiple agencies working 

cohesively together. 

121 President’s Task Force on 21st Century Policing, Final Report (see note 4), 36. 

122 International Association of Chiefs of Police, Emergency Preparedness and Response Fact Sheet (Washington, 

DC: Bureau of Justice Assistance, 2013), 

http://www.iacpsocialmedia.org/Portals/1/documents/Fact%20Sheets/Emergency%20Preparedness%20Fact%20S 

heet.pdf. 

94 Bringing Calm to Chaos: The San Bernardino Public Safety Response 
 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

During preparations for the scripted press conferences, the sheriff’s social media specialist noted 

important points during command-level meetings to use at coordinated times. As law enforcement 

leaders addressed the press, the social media specialist tweeted statements that coincided with 

what was being said at the press conference, allowing for a multiplatform delivery of information to 

the public. 

The SBCSD also had one of its Spanish-speaking PIOs at all of the press conferences. The PIO provided 

information to the Spanish-speaking press, including doing interviews for television broadcasts done in 

Spanish at the conclusion of press conferences. 

A great many press requests were made early on for one-on-one interviews. Some were given when it 

was feasible, particularly with major cable news outlets. The public affairs units also intervened when 

journalists overstepped their bounds. For example, reporters from a cable news network showed up at 

the home of one of the first responders to the incident. They were counseled to not attempt to reach 

law enforcement personnel at their homes. A press conference planned that day was canceled, and 

journalists were informed that the cancellation was because of the attempted interview. The press 

made no more attempts for similar interviews. When it was possible, the two local agencies (SBPD and 

SBCSD) made sure to give local press contacts additional interviews as a way to strengthen the relationship with them and ultimately the communities they serve. 

SBCSD officials praised training efforts made in the months prior to the December 2 attacks that set a 

framework for a relatively smooth process. This extended to having the public affairs unit in training 

exercises, which had not been done in the past but facilitated the success of the response. 

As was to be expected, not every aspect of the response went smoothly. In the early stages of the event, 

the SBCSD set up a 1-800 number for people to call for information about their loved ones. Unfortunately the process moved too quickly, and the number was broadcast before staff had been put in place to 

answer the phones. Eventually, staff members were set up to take calls, but by that point, many people 

had called for information and had not been able to speak with anyone. That upset victims’ relatives and 

generally created unnecessary frustration. 

It was important to show the public the unified front of 

multiple agencies working cohesively together. 

8. Community Engagement, Relationships, and Public Information 95 
 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

Best Practices from the Field: The Boston Marathon Bombings 

In t he hours and days following the Bosto n Marathon bombings in 2013, the Boston 

Police Department’s (BPD) Media Relations Office used social media, including the 

department’s official Twitter account, to effectively manage the dissemination of 

timely and accurate information to the public. Thro ugh Twitter, the BPD was able to 

quick ly correct misinformation being spread in t he professional media and t hrough 

social networks. T he BPD’s use of Twitter has since been commended as t he first time 

that tweets were successfully use d by a police depa rtment to engage wit h the 

community during a t ime of crisis. In Social Media and Police Leadership: Lessons 

from Boston, a report by the Program in Criminal Just ice Policy and Management at 

Harvard Kennedy Scho ol and coauthore d by former BPD Commissioner Edward F. 

Davis III, the authors wrote that “BPD tweets rapidly became the most trusted source 

of informatio n abo ut t he stat us of the investigation and were ofte n retweeted 

hundre ds, t housands, or tens of tho usands of times.” 

_______________________ 

Source: Edward F. Davis III, Alejandro A. Alves , and David Alan Sklansky, Social Media and Police 

Leadership: Lessons from Boston, New Perspectives in Policing Bulletin (Washington, DC:

National Institute of Justice, 2014), https://www.ncjrs.gov/pdffiles1/nij/244760.pdf. 

Elected officials 

Members of the press were not the only group to descend upon the scene in large numbers. Many local 

legislators came to the IRC looking for information that they could then share with their constituents. In 

some cases, the legislators merely wanted to stand behind the law enforcement leaders at the press 

conferences to show their support. This was allowed as long as the legislators understood they would 

not be speaking. In other cases, some expected to be involved in operational plans. The public affairs 

staff had to explain the necessity of closed meetings involving confidential information. Again, this was 

well received because of the relationships that had been built previously. Legislators ultimately received 

important information about the incident at secondary briefings. 

Generally, the encounters with legislators went smoothly as the SBCSD employs a legislative liaison who 

works with elected politicians on a daily basis. During the initial phase of the event, the liaison was left 

in the main office to answer calls, but with the growing number of legislators at the scene, sheriff’s officials realized they needed to have the liaison on location. The liaison guided legislators, advising them 

on the balance between focusing on the victims and conducting interviews with the media. In addition, 

just as the media had been told, legislators were encouraged to keep abreast of the news by following 

the agencies’ social media accounts. A few federal legislators called the liaison and law enforcement 

leaders directly to say they were staying away from the scene but to offer their support and resources if 

anything was needed. 

96 Bringing Calm to Chaos: The San Bernardino Public Safety Response 
 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

Community liaisons 

The SBCSD’s public affairs unit also includes several community liaisons. One of the liaisons is responsible for developing relationships with communities of faith, including the local Muslim community, which 

has a half dozen mosques in the area. Other local police departments do the same, including the Redlands Police Department. 

In the aftermath of the event, the SBCSD received several phone calls from members of the local Muslim 

community because of fears of retribution. They asked for advice and protection. Some of the mosques 

were in the jurisdiction of the SBCSD; others were outside of it, and their concerns were passed on to 

the appropriate departments. Additional police patrols were made at local mosques. Although there 

were no local incidents threatening or desecrating local mosques, some cases were reported in other 

parts of southern California during that time.

123 

The public affairs team also sent representatives, sometimes department leaders, to news conferences 

held by local mosques to denounce the violent attack. As occurs in some communities, lack of trust had 

made forming strong community-police relationship within the Muslim community difficult. Interestingly, the liaison reported that following the incident, relationships improved between the department and 

local Muslim leaders. In an interview that took place months after the attack, a member of a mosque in 

Chino (the largest mosque in the area, about 30 minutes to the west of San Bernardino) said the incident was extremely disturbing and painful for the Muslim community. He said, “It was an attack on us in 

a lot of ways because we have been casting a narrative that is focused on fighting terrorism. [Extremists] 

have hijacked a platform and a scripture that we believe doesn’t relate to any of this.” He also added, 

“There is nothing worse than your neighbor being suspicious of you. I don’t know how it feels to be persecuted, but I can appreciate it. Even if it is an honest suspicion, you feel you have to do something.” 

In response, the mosque opened its doors to the public and held a meeting to welcome in their neighbors. More than 300 people came, including representatives of local law enforcement. The mosque has 

also joined in an effort called “True Islam,” and has a website to promote it.124 

123 Casey Harper, “California Mosques Fall Victim to String of Hate Crimes Following San Bernardino Shooting,” The 

Daily Caller, last modified December 14, 2015, http://dailycaller.com/2015/12/14/california-mosques-struck-byhate-crimes-after-san-bernardino-shooting/. 

124 “True Islam and the Extremists,” Ahmadiyya Muslim Community, accessed June 22, 2016, 

http://www.trueislam.com. 

8. Community Engagement, Relationships, and Public Information 97 
 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

Community engagement, relationships, and public information lessons learned 

Law enforcement leaders in San Bernardino recognize the importance of community trust and long-term 

relationships with local leaders. They also fully appreciate the public expectation for timely and accurate 

information regarding events within the region. Critical to the public information strategy is the use of 

social media. 

Public affairs and media management 

Social media 

8.1 Using social media such as Twitter, Facebook, YouTube, Instagram, Periscope, Flickr, 

NextDoor.com, and others has become critical for releasing timely and accurate information both to the 

public and to the traditional media. By being active on social media leading up to critical incidents, law 

enforcement agencies can better inform the public. 

Information releases 

8.2 The involvement of line staff responsible for the release of information to the public in executive 

level strategy meetings proved critical in deciding which information should be released while allowing 

for a unified message to be relayed from multiple agencies and platforms. 

Develop media response through exercise 

8.3 Public affairs units should be included in all training, whether it is conducted as a tabletop or a live 

exercise. Also, creating a system to classify multiple levels of response to different sorts of events for public affairs units will only improve the ability to respond quickly and effectively. 

Public affairs staff reported that being involved in regional active shooter training better prepared 

them for the IRC response. They also noted that the ability to use simulated social media sites identified 

potential response problems and allowed them to more quickly provide information to the public. 

98 Bringing Calm to Chaos: The San Bernardino Public Safety Response 
Legislative andcommunity relationships 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

8.4 When possible, identify a liaison to work directly with and coordinate elected officials’ involvement in the incident response. Liaisons should be at the scene, not in the office, as this is where many 

politicians will likely be located. The liaison can help officials stay focused on predesignated duties and 

responsibilities rather than being involved on scene or on camera when such involvement is outside the 

scope of the officials’ jurisdictions or duties. 

Legislative leaders can positively impact community trust. They play an important role in keeping elected politicians appropriately informed while allowing law enforcement leaders to focus on operations. 

8.5 Law enforcement should establish and build upon relationships with communities of faith and faith 

leaders. These relationships need to be established over time and with proactive efforts prior to any sort 

of major incident. 

The SBCSD has a liaison to various communities of faith within the area, including the Muslim community. Departments should consider assigning liaisons to maintain strong relationships and open lines of 

communication. 

125 

8.6 After an incident occurs that could negatively impact a specific community, law enforcement 

should take added steps to protect them from potential retribution and advise them how to handle possible threats. 

8.7 When establishing any type of public hotline, the infrastructure and staffing must be in place 

before a public announcement is made. 

8.8 Law enforcement agencies must keep in mind the need to work with and prepare community 

members who own property that is involved in high profile crimes for the national and possibly international attention it will draw from the media. 

This attention can be overwhelming on multiple levels to people who are not accustomed to dealing 

with the media. By reaching out and working with these community members, law enforcement agencies show their willingness to be proactive in their communities. 

125 The existing relationship between the SBCSD and members of the Muslim community greatly assisted the Police 

Foundation team. 

8. Community Engagement, Relationships, and Public Information 99 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

9. Post-Event Responder and 

Victim Welfare 

“While the first tasks in disaster management are to secure the scene, to triage, and to evacuate victims 

to definitive care, the disaster plan fails if it stops at the hospital door,” according to Jeffery Hammond 

and Jill Brooks.

126 “It has been recognized that both disaster victims and workers are at risk for acute and 

chronic post-traumatic stress disorder (PTSD).” Studies by North, Herman, and their colleagues also suggest that the experience of responding to terrorist attacks significantly increase the risk of symptoms of 

PTSD and other psychiatric sequelae.127 These findings have led to “attempts to intervene early so as to 

prevent, or at least minimize psychological morbidity following traumatic events.”128 

After initially staging victims and witnesses at the San Bernardino Golf Course, the decision was made to 

transport more than 400 witnesses to the Rock Church and World Outreach Center on buses obtained 

with the assistance of the San Bernardino City Unified School District Police. The Rock Church was a 

large facility with services, food, beverages, and ample parking. According to the designated incident 

commander at the Rock Church, their “first thought was [to] get dignity back to the victims.” 

Figure 5 on page 102 shows the location of the staging areas in relations to other relevant locations in 

the December 2 incident. 

126 Jeffrey Hammond and Jill Brooks, “The World Trade Center Attack: Helping the Helpers: The Role of Critical 

Incident Stress Management,” Critical Care 5, no. 6 (December 2001), 315–317, doi: 10.1186/cc1059. 

127 Carol S. North et al., “Psychiatric Disorders in Rescue Workers after the Oklahoma City Bombing,” American 

Journal of Psychiatry 159, no. 5 (May 2002), 857–859, 

http://ajp.psychiatryonline.org/doi/pdf/10.1176/appi.ajp.159.5.857; Daniel Herman, Chip Felton, and Ezra Susser, 

“Mental Health Needs in New York State Following the September 11th Attacks,” Journal of Urban Health 79, no. 3 

(September 2002), 322–331, doi: 10.1093/jurban/79.3.322. 

128 Hammond and Brooks, “The World Trade Center Attack” (see note 126). 

101 
 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

Figure 5. Relative locations of events and staging areas 

Upon arrival, the victims and witnesses were separated into two groups based on their level of involvement in the incident. One group was made up of people who witnessed the shooting, observed the 

shooters, or were able to provide critical information regarding the incident. The second group was 

made up of people who had indirect knowledge of the shooting; for example, they may have heard gunshots or assisted injured people. 

SBPD detectives and officers audio recorded all of the primary victim and witness interviews. Law 

enforcement personnel from other agencies interviewed all secondary witnesses. Every person that was 

interviewed was also photographed. After the interviews were completed, the witnesses were transported to the Rudy C. Hernandez Community Center, where they were reunited with their families. 

However, because the media had staged at the Hernandez Center, victims and witnesses had to walk 

through them prior to entering the center. 

The San Bernardino County Coroner established a family assistance center at the Hampton Inn for the 

families of the deceased. Security was provided by the SBCSD. Inside, approximately two dozen tables 

that seated eight people each were set up and staffed with coroner’s office personnel and members of 

the behavioral health team. In addition, a buffet was set up and drinks were available. 

Clergy from numerous local houses of worship self-deployed to both the Rock Church and the Hernandez Community Center. Counselors were also available at both facilities. Victims indicated that they had 

difficulty identifying chaplains and counselors; as a result, neither clergy members nor counselors were 

able to provide significant services to the victims. 

102 Bringing Calm to Chaos: The San Bernardino Public Safety Response 
9. Post-Event Responder and Victim Welfare 

 

 

 

 

 

 

 

 

 

 

Best Practices from the Field: The Boston Marathon Bombings 

In t he aftermath of the bombings at t he Boston Marathon in 2013, runners w ho were 

outside t he city limits were directed to a series of temporary safe havens unt il t hey 

could be transferred to a centralized location where t hey could co llect the ir 

belongings and receiv e counseling and othe r support se rvices. Once the decision was 

made to have this centralized location—referred to as t he Family Reunificat ion 

Center—at the Castle at Park Plaza, t he City of Boston went to gre at lengths to 

ensure t he privacy of individuals arriving to obtain information a nd gat her t heir 

belongings, including instit uting media restrictions ne ar and in t he Castle. This 

provide d a level of co mfort to indiv iduals seeking guida nce a nd services at t he 

Castle. 

In addition, through t he partnership of local, state, and federal a gencie s, the Boston 

Public Health Commission also opened a separate Family Assistance Center ( FAC) with 

the mission of coordinating services and resources for survivors, t heir familie s, a nd 

the families of t he victims. The FAC services include d mental healt h counseling, 

spiritual care, and other care. T he location of the center was not publicly disc losed, 

and se curity was in place to ensure privacy of all individuals. 

_______________________ 

Source: After Action Report for the Response to the 2013 Boston Marathon Bombings (Boston: 

Massachusetts State Police, 2014), http://www.mass.gov/eopss/docs/mema/after -action- reportfor -the- response-to-the-2013-boston-marathon-bombings.pdf. 

San Bernardino County District Attorney victim service advocates reported that it was very difficult to 

obtain and share accurate information with families of victims. This caused some families to travel to 

area hospitals in an attempt to locate victims. In one case, a victim’s husband was told that his wife had 

died, only to find out that although she had been shot she was stable and in a different hospital. Victims 

expressed concern that there were significant delays in notifying family members of the deceased. The 

victim service advocates assisted the coroner in making death notifications on the day after the incident. 

Victims said the initial response by first responders was what they expected based on previous active 

shooter training. They expressed frustration and concern for their safety while they waited on the San 

Bernardino Public Golf Course for more than three hours before being transferred to the Rock Church. 

Many victims were upset because they were unable to contact their family members as they either were 

without phones or their phone batteries had died. They also expressed concern about the length of time 

they had to wait in line to have their photographs taken before they were transported to the Hernandez 

Center. 

Some county employee victims were also upset because they were unable to access benefits in a timely manner, were not provided adequate counseling services, and were expected to return to work within days of the event. An IRC employee expressed concern that they received limited counseling and 

103 
 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

remarked that at the time of the interview some employees had yet to receive any counseling. Some 

first responders also expressed concern and frustration regarding their inability to obtain counseling 

services or follow up from their agency administrators. 

Responder mental health 

In San Bernardino, first responders in all agencies involved in the terrorist shooting incident experienced varying levels of support and intervention in the days and weeks that followed. During interviews, the team became acutely aware that the emotions brought up by memories of the incident in 

some of the responders were still very raw and not yet processed. While many reported that their 

departments immediately provided and continue to provide considerable mental health trauma support, others struggled with identifying how to get the help they needed. 

Active shooter and other hostile event incidents take an emotional toll on all involved as well as 

those watching it play out from elsewhere in the community, across the nation, and around the world. 

Addressing the mental health impact, particularly of the victims and the first responders, is imperative. 

Not only can this trauma, if left untreated, hinder the healing of the entire community but unaddressed 

trauma can also create officer safety and work performance issues in police departments.129 

The culture of policing has historically not embraced the need to attend to the mental health of police 

personnel. Cops are expected to be tough, resilient, and able to bounce back without much mental 

health treatment or professional attention. In fact, some of the officers and civilians advised the team 

that they struggled with the stigma of asking for help and appearing weak to their colleagues. One civilian department employee told the team that he had teased one of his colleagues who had attended a 

critical incident debriefing. 

The law enforcement profession is beginning to recognize that resilience does not automatically happen; it takes time, attention, and support. The Final Report of the President’s Task Force on 21st Century 

Policing recognized that the culture of law enforcement stigma needs to change, saying, “This transformation should also overturn the tradition of silence on psychological problems, encouraging officers to 

seek help without concern about negative consequences.”130 

Leadership is critical in setting the tone for open and honest dialogue about the mental health needs 

of an entire department, particularly in time of crisis. “In a critical incident it is easy for the department 

to single out personnel it believes are impacted and provide support to them. It is hard to make such a 

129 Usher et al., Preparing for the Unimaginable (see note 81), 14.
 

130 President’s Task Force on 21st Century Policing, Final Report (see note 4), 62.
 

104 Bringing Calm to Chaos: The San Bernardino Public Safety Response 
 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

judgment when the personnel involved in the critical incident may not even know they need help.”131 

It is important that the department acknowledge and provide support to all personnel who are 

involved in the critical incident. All involved personnel have the potential to experience stress reactions, and targeting only those who demonstrate an obvious need for the support can create immediate 

and future issues related to post-traumatic stress. “It is better for the department to treat all employees 

consistently.”132 

131 IACP National Law Enforcement Policy Center, Critical Incident Stress Management: Concepts and Issues Paper 

(Alexandria, VA: International Association of Chiefs of Police, 2011), 2, 

http://www.theiacp.org/Portals/0/documents/pdfs/MembersOnly/CriticalIncidentStressPaper.pdf. 

132 Ibid. 

Post-event responder and victim welfare lessons learned 

Law enforcement leaders and personnel in San Bernardino recognized the need to remove victims and 

witnesses from the IRC to the San Bernardino Golf Course for safety, triage, treatment, and transport to 

the appropriate medical facilities. They also recognized the importance of returning dignity to the victims as well as the importance of interviewing victims and witnesses in a safe, stable, and more comfortable environment. The San Bernardino public safety agencies established a system that would do 

that, but they also learned lessons in the process. There also exist opportunities to learn from the need 

to address responder mental health needs following critical incidents. 

Reunification 

9.1 Designate a family reunification center. 

9.2 Establish and maintain access control and security as soon as the family reunification center is 

established. 

9.3 Designate one or more areas near but not immediately adjacent to the family reunification center 

where the public and the media can gather without interfering. 

9.4 Jurisdictions and communities facing similar challenges should consider venue security and controlled media staging areas and identify opportunities that facilitate reunification. 

9. Post-Event Responder and Victim Welfare 105 
 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

Reuniting families at the Hernandez Community Center reduced confusion and facilitated victim 

and witness interviews at the Rock Church. However, victims and witnesses should not have had to 

walk through a media gauntlet. In the aftermath of the Boston Marathon bombing, the City of Boston 

ensured the privacy of individuals arriving at their designated Family Reunification Center, which provided a level of comfort to victims and those seeking guidance and services.133 

Making clergy and counseling available 

9.5 Designate a special area where clergy and counselors can assemble within the family reunification 

center. 

Make sure clergy and counselor areas are easily and clearly identifiable. Make sure victims, family members, and friends are aware that clergy and counselors are present. Let clergy know that victims, family 

members, and friends will initiate contact with them if they want assistance. 

9.6 Provide training regarding Psychological First Aid to clergy members and chaplains who are designated to respond to mass casualty and critical incidents. 

9.7 Credential clergy and counselors so that they are vetted, properly trained, and readily identifiable 

as such to prevent untrained persons from entering secured areas. 

Communicating victim information 

9.8 Be prepared to explain to families of victims why identification of the deceased takes so long. 

Families should be given general information about how and why the crime scene has to be processed 

before the deceased can be processed—and how long both processes generally take. 

9.9 In mass casualty events, notifications should be made in a timely manner to lessen the stress on 

family members or significant others as they are waiting notification about loved ones involved in the 

incident. Whenever possible, notifications should be made in person. 

The San Bernardino Coroner’s office made all notifications in person. However, some family members 

were angry that it took so long to be notified. According to the captain assigned to the coroner’s office, 

“They were already expecting it. They were already prepped for it. They just needed to know.” The captain explained that the coroner’s division policy is being reviewed to improve their notification protocols 

and to ensure consistency with best practices. 

133 After Action Report for the Response to the 2013 Boston Marathon Bombings (Boston: Massachusetts State 

Police, 2014), 105, http://www.mass.gov/eopss/docs/mema/after-action-report-for-the-response-to-the-2013­

boston-marathon-bombings.pdf. 

106 Bringing Calm to Chaos: The San Bernardino Public Safety Response 
 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

9.10 If possible, establish one file on victim information to avoid conflicting or incomplete information 

being given to significant others. 

Hospitals, police, emergency management services (EMS), and victim advocates are the primary suppliers and users of this information and should work together to create a template and protocols for mass 

casualty incidents. This recommendation could be difficult to implement because of the Health Insurance Portability and Accountability Act (HIPAA) and other confidentiality issues. 

Victim andwitness accommodations 

9.11 Jurisdictions and communities faced with similar challenges of managing large numbers of 

victims and witnesses (in this case more than 400 people) should identify safe, stable, and comfortable 

facilities in advance of an incident. Natural disaster preparedness serves as model for predesignated 

areas. 

As previously mentioned, victims expressed concern regarding the amount of time spent on the golf 

course (approximately three hours). 

9.12 Consider provisions for victim and witness care while they are awaiting interviews and family 

members are being notified. These may include making cell phone charging stations and other forms of 

communication available and making food and water available. Counselors should be clearly identified 

with arm bands, vests, or similar so that they are readily identified by victims and witnesses. 

While the Rock Church provided an appropriate venue, victims expressed concern and frustration with 

the inability to contact family members, lack of counseling services, and the lengthy interview and photographing process. 

9.13 Jurisdictions and communities challenged by the need to interview large numbers of victims should 

consider staffing implications and request assistance from other agencies if appropriate. 

While it is completely understandable that the SBPD wanted to interview all victims and witnesses with 

firsthand knowledge of the event for continuity and evidence purposes, it did contribute to victim frustration and concern. 

9.14 Jurisdictions and communities challenged by victim and witness accountability should consider 

methods for expediting the process to reduce stress on victims and witnesses. 

Photographing victims and witnesses was an appropriate and important decision to ensure that all 

involved persons were accounted for. However, victims were frustrated by the length of time it took 

to do this. 

9. Post-Event Responder and Victim Welfare 107 
Victim andresponder mental health 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

9.15 Post-event victim and responder welfare should be an integral part of interagency planning, training, and exercises. 

Having several appropriate spaces identified that can handle the various stages (triage, interviews, counseling, etc.) of events will serve both victims and their unique needs as well as responders effectively by 

ensuring a safe space to interview and provide services to victims and their families. Planning and training should also include action plans to ensure services are provided to both victims and responders following the “end” of an event and before returning to normal work. 

9.16 Ensure your department has a policy regarding mental health support after critical incidents, and 

clearly communicate it to the entire department.134 

9.17 Assign a mental health or officer wellness incident commander to oversee officer mental health 

and coordinate services among participating agencies.

135 

9.18 Compel participation in critical incident debriefings or post-incident counseling both for victims and 

civilian and commissioned staff. 

It is clear that victims and first responders to terrorist or active shooter or other hostile events or 

mass casualty incidents run a significant risk of immediate or prolonged psychological morbidity (or 

both). Jurisdictions and communities facing similar challenges should ensure, if not compel, participation 

in critical incident debriefings or post-incident counseling. In addition, agency leaders should endeavor 

to provide debriefings for their departments, sub-units, and individuals in a timely and appropriate 

manner. 

9.19 Consider follow-up counseling as it is not unusual for post-traumatic stress to manifest itself several weeks or months after an event. 

9.20 In addition to mental health assistance, consider unit, team, or department-level debriefings to 

bring closure to the event. 

134 Usher et al., Preparing for the Unimaginable (see note 81). 

135 Ibid. 

108 Bringing Calm to Chaos: The San Bernardino Public Safety Response 
 

 

 

 

 

 

 

 

 

 

 

 

 

 

Section IV. Conclusion 

Conclusion 

In a time of considerable scrutiny of police practices and community relationships, the terrorist attacks 

in San Bernardino bring to light the very real threats that communities and the law enforcement agencies tasked with protecting those communities face every day. There is no doubt that we all must work 

together to counter these threats and focus on public safety. 

Many of the lessons learned during the response on December 2, 2015, continue to build on the body of 

knowledge that exists to assist law enforcement agencies in their ability to protect and strengthen relationships with their community. Several tie into the principles of community policing and even parallel 

pillars of the Final Report of the President’s Task Force on 21st Century Policing. As the Police Foundation 

continues to work to advance policing through innovation, it is no surprise that the lessons learned on 

that day tie to the ideals of 21st century policing. 

The lessons learned in this report, and the Critical Response as a whole, add to the growing body of literature that public safety agencies can use to enhance their preparation for—and response to—active 

shooter and other hostile events, including future terrorist attacks. 

109 

 

 

 

 

 

 

 

 

 

 

 

 

 

Abbreviations, Acronyms, and Initialisms
 

ALERRT Advanced Law Enforcement Rapid Response Training 

ATF Bureau of Alcohol, Tobacco, Firearms, and Explosives 

CAD computer-aided dispatch 

CHP California Highway Patrol 

COPS Office Office of Community Oriented Policing Services 

CRTA Critical Response Technical Assistance program 

DHS U.S. Department of Homeland Security 

DOJ U.S. Department of Justice 

FBI Federal Bureau of Investigation 

FEMA Federal Emergency Management Agency 

HSI Homeland Security Investigations 

IAB InterAgency Board 

111 
 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

IAFF International Association of Fire Fighters 

ICS incident command system 

IRC Inland Regional Center 

IVS Inland Valley Regional special weapons and tactics (SWAT) team 

JIC Joint Information Center 

NIMS National Incident Management System 

PF Police Foundation 

PIO public information officer 

PTSD post-traumatic stress disorder 

SBCSD San Bernardino County Sheriff's Department 

SBCUSD San Bernardino City Unified School District 

SBFD San Bernardino Fire Department 

SBPD San Bernardino Police Department 

SWAT special weapons and tactics 

UCC Unified Command Center 

112 Bringing Calm to Chaos: The San Bernardino Public Safety Response 
 

 

 

 

 

 

Appendix A. Lessons Learned
 

4.1 Organizational leadership should ensure that all involved in the response feel valued and are 

provided access to the physical and mental health resources they may need after a critical incident. 

Agencies should identify best practices related to employee wellness. 

4.2 Regularly review the lessons learned from critical incidents with regional first responders and 

develop trainings that incorporate lessons and promising practices. 

4.3 Include representatives from all levels of the organization in critical decisions to enhance 

outcomes. 

4.4 Predetermine elected officials’ roles and responsibilities in managing critical incidents, and 

include them in critical incident training and exercises. 

4.5 The intense media coverage associated with a high-profile event is often overwhelming and 

will place additional demands on leaders that may take them away from daily operations. These 

demands will continue long after the conclusion of the incident, requiring leaders to constantly assess 

the effects the increased attention and notoriety bring on themselves and the organization. 

4.6 Publicly demonstrate and recognize the collaboration and support from others. 

5.1 Agencies should routinely examine critical incident reviews and plan at a regional level for the 

possibility of similar events. 

5.2 Agencies should use ICS beyond large-scale tactical events and incorporate as many of the 

principles as possible in response to routine emergencies so it becomes a regular component of a 

department’s operating philosophy. 

5.3 Regional public safety partners should plan and exercise unified command for complex 

incidents on a regular basis. This includes law enforcement, fire, EMS, and emergency management as 

well as other government and nongovernment agencies as appropriate. 

5.4 As soon as possible and practical during an incident, establish a unified command of all 

primary first responders to facilitate communication, situational awareness, operational coordination, 

allocation of resources, and delivery of services. 

5.5 After adequate personnel are on scene, additional personnel should be directed to staging 

areas for assignment of duties. As described in a variety of NIMS courses, designating a staging area 

manager is critical during the early moments of the response. 

113 
 

 

 

 

 

 

 

 

 

5.6 Agencies must plan for potential chaos created by public safety personnel responding to an
 

active shooter.
 

5.7 Agencies should anticipate and plan a timely transition from the somewhat chaotic active
 

shooter response to a more methodical search for possible suspects, triage of victims, and victim and
 

witness extrication.
 

5.8 Responders should constantly evaluate security risks of command post locations and make
 

appropriate adjustments as required.
 

5.9 Send pictures or maps of the area—building layouts, parking lots, streets, and the like—to
 

dispatch and vehicle mobile data terminals (MDT). Employ technology, such as such as helicopters,
 

unmanned aircraft systems (UAS), or pre-existing camera systems (as available) to produce information
 

in real time.
 

5.10 It is the responsibility of each first responder to assess a situation while en route to an active 

shooter incident as well as after arriving to determine if they are needed as part of the response. If an
 

officer has initiated action at a scene or been assigned a specific task the officer should not leave unless
 

directed to do so.
 

5.11 Supervisors must anticipate the likelihood of unnecessary self-deployment and make efforts to
 

discourage and restrict officer response.
 

5.12 Agencies must continually plan and evaluate ingress and egress routes during critical incidents.
 

An incident safety officer should be designated as quickly as possible and pay particular attention to the
 

access or egress of emergency vehicles. Ambulance and medical transport should be given a high
 

priority task for police and fire incident command.
 

6.1 Because initial responders to a critical incident may be from a variety of agencies, regional
 

training improves performance in a crisis response and should include all disciplines and levels of first
 

responders. Fire, EMS, and other potential first responders should be included in in-service active
 

shooter training as appropriate.
 

6.2 In-service training, regardless of the topic, should be updated on an annual basis and meet
 

federal, state, and other appropriate certification standards.
 

6.3 The ability to understand and apply response strategies in a high-stress environment improves
 

performance. Training should attempt to create as much sensory deprivation or stimulus as possible to
 

simulate real-world scenarios.
 

6.4 First responders should be familiar with critical infrastructure as well as facilities that regularly
 

bring large numbers of people together. Consideration should be given to reducing or eliminating 

environmental stressors if possible. Sound, darkness, and other environmental stressors can make it
 

difficult to find and identify suspects and may hinder evacuations as well as search and rescue efforts.
 

114 Bringing Calm to Chaos: The San Bernardino Public Safety Response 
 

 

 

 

 

 

 

 

 

6.5 Law enforcement agencies should train all officers in tactical emergency medical care. 

6.6 Active shooter training should include transition from a dynamic active shooter situation (a 

situation that is evolving very rapidly consistent with the suspect's actions) to a static situation (a 

situation that is not evolving or in motion because the suspect[s] is contained, has escaped, or is 

incapacitated). Training should recognize that active shooter incidents may evolve from dynamic to 

static situations and possibly back to dynamic or mass casualty situations requiring transitions over the 

course of the police response. 

6.7 Training exercises should continue past the point where the threat no longer exists and extend 

to the notification of victims’ families by the medical examiner or coroner. 

6.8 Training should include secondary device identification, notification, and isolation. 

6.9 Civilian and private sector training for an active shooter event can save lives. Inform the public 

of appropriate measures to take if they are involved in an active shooter or other hostile event, and 

provide a general overview of the police response. 

6.10 Communications centers should hold regular interdepartment interoperability communication 

drills with regional public safety agencies. Human and equipment communication issues should be 

identified and remedied during communication drills and joint exercises. 

6.11 Dispatch centers should be included in incident command system (ICS) training, which should 

include testing public safety proficiency in using radio and other communication systems. 

6.12 Because dispatch systems can quickly become overwhelmed in a mass casualty, active 

shooter, or other critical incident, agencies should develop a tactical dispatcher system that provides a 

dedicated dispatcher responsible for the operational needs of the incident and tactical commander. 

6.13 Develop a system and protocols for diverting nonemergency calls elsewhere as well as 

establishing protocols to handle calls from family, friends, and media. 

6.14 During large-scale multiagency events, dispatch personnel should be colocated to facilitate 

information exchange and resource coordination and to compliment ICS. 

6.15 CAD systems should be load tested to ensure the systems can handle a significant event lasting 

a long period of time. 

6.16 Training exercises should simulate a system slowdown or shutdown during a crisis and 

describe alternative communication strategies and protocols. 

6.17 Agencies should identify facilities within their communities that pose radio transmission and 

reception difficulties and use those facilities to train personnel and identify ways to mitigate poor 

communication so they are prepared should an incident occur. 

Appendix A. Lessons Learned 115 
 

 

 

 

 

 

 

 

 

 

 

 

6.18 Agencies must reinforce radio discipline. Merely increasing radio capacity alone does not 

reduce the volume nor does it establish a priority of communication. It is an officer’s responsibility 

based upon training and agency policy to differentiate between critical radio communication and less 

critical communication that does not need to be broadcast. 

6.19 Additional consideration should be given to merged radio systems and protocols between law 

enforcement, fire, and EMS. 

6.20 The ability to communicate using encrypted channels improves communication without 

jeopardizing officer and community safety. 

6.21 Ensure that communications extend to the appropriate public safety organizations even if the 

technology in use does not automatically do so. 

6.22 Pre-incident planning should include timely access to building diagrams, particularly critical 

infrastructure and plans of buildings where large numbers of persons gather on a regular basis. 

6.23 Regions should adopt a standardized marking system, similar to the International Search and 

Rescue Advisory Group marking system, for easy identification of areas searched, cleared, and secured 

by law enforcement personnel. 

6.24 Law enforcement agencies should establish training and protocols for the use of rapid entry 

systems used by fire and EMS providers so that the need to breach locked or barricaded doors is 

reduced. 

6.25 States should establish a resource typing system, similar to the system used by the fire service, 

to categorize and track available resources that may be required to respond to a critical incident. 

6.26 Public safety agencies should consider how they will deploy emergency medical responders in 

active shooter or other hostile events to ensure victim triage, extrication, and treatment. 

6.27 To reduce the amount of time it takes for victims to receive medical care regions should 

establish medical tactical teams designed to work in a “warm zone,” allowing victims to be moved more 

quickly to a mass casualty triage area. 

6.28 Agencies should ensure adequate protective gear is issued to personnel that may respond to 

an active shooter incident. Equipment should include active shooter armor kits (ballistic helmets and 

ballistic vests with ceramic plates) that afford greater protection from high-powered semi- and fully 

automatic weapons and ammunition. 

6.29 Law enforcement agencies should equip officers with personal tactical emergency medical 

kits. 

116 Bringing Calm to Chaos: The San Bernardino Public Safety Response 
 

 

 

 

 

 

 

 

 

 

 

6.30 If equipment is incorporated as an integral part of training, officers should have the equipment 

issued and available to them. 

6.31 Response protocols should include positioning heavy fire response vehicles as shields from 

secondary devices and active shooters. 

7.1 All first responder agencies must recognize that not all mass casualty incidents are crime 

scenes (for example, natural disasters are not crime scenes), but all terrorist events are. All responders 

to a potential terrorist incident should understand the importance of evidence preservation, 

documentation, and collection. 

7.2 Critical incident management is greatly enhanced when there are pre-existing relationships 

between leaders and field supervisors from all potential first responder agencies. 

7.3 A determination should be made in identifying agencies with the best skills and tools to 

perform investigative tasks. Jurisdictional investigative authority does not necessarily correlate with 

investigative skills, abilities, training, and equipment. 

7.4 Critical incident training and exercises should include an investigative component that includes 

identifying all aspects of victim and witness identification, interviewing, and reunification. 

8.1 Using social media such as Twitter, Facebook, YouTube, Instagram, Periscope, Flickr, 

NextDoor.com, and others has become critical for releasing timely and accurate information both to the 

public and to the traditional media. By being active on social media leading up to critical incidents, law 

enforcement agencies can better inform the public. 

8.2 The involvement of line staff responsible for the release of information to the public in 

executive level strategy meetings proved critical in deciding which information should be released while 

allowing for a unified message to be relayed from multiple agencies and platforms. 

8.3 Public affairs units should be included in all training, whether it is conducted as a tabletop or a 

live exercise. Also, creating a system to classify multiple levels of response to different sorts of events 

for public affairs units will only improve the ability to respond quickly and effectively. 

8.4 When possible, identify a liaison to work directly with and coordinate elected officials’ involvement in the incident response. Liaisons should be at the scene, not in the office, as this is where many 

politicians will likely be located. The liaison can help officials stay focused on predesignated duties and 

responsibilities rather than being involved on scene or on camera when such involvement is outside the 

scope of the officials’ jurisdictions or duties. 

8.5 Law enforcement should establish and build upon relationships with communities of faith and 

faith leaders. These relationships need to be established over time and with proactive efforts prior to 

any sort of major incident. 

Appendix A. Lessons Learned 117 
 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

8.6 After an incident occurs that could negatively impact a specific community, law enforcement 

should take added steps to protect them from potential retribution and advise them how to handle 

possible threats. 

8.7 When establishing any type of public hotline, the infrastructure and staffing must be in place 

before a public announcement is made. 

8.8 Law enforcement agencies must keep in mind the need to work with and prepare community 

members who own property that is involved in high profile crimes for the national and possibly 

international attention it will draw from the media. 

9.1 Designate a family reunification center. 

9.2 Establish and maintain access control and security as soon as the family reunification center is 

established. 

9.3 Designate one or more areas near but not immediately adjacent to the family reunification 

center where the public and the media can gather without interfering. 

9.4 Jurisdictions and communities facing similar challenges should consider venue security and 

controlled media staging areas and identify opportunities that facilitate reunification. 

9.5 Designate a special area where clergy and counselors can assemble within the family 

reunification center. 

9.6 Provide training regarding Psychological First Aid to clergy members and chaplains who are 

designated to respond to mass casualty and critical incidents. 

9.7 Credential clergy and counselors so that they are vetted, properly trained, and readily 

identifiable as such to prevent untrained persons from entering secured areas. 

9.8 Be prepared to explain to families of victims why identification of the deceased takes so long. 

9.9 In mass casualty events, notifications should be made in a timely manner to lessen the stress 

on family members or significant others as they are waiting notification about loved ones involved in the 

incident. Whenever possible, notifications should be made in person. 

9.10 If possible, establish one file on victim information to avoid conflicting or incomplete 

information being given to significant others. 

9.11 Jurisdictions and communities faced with similar challenges of managing large numbers of 

victims and witnesses (in this case more than 400 people) should identify safe, stable, and comfortable 

facilities in advance of an incident. Natural disaster preparedness serves as model for predesignated 

areas. 

118 Bringing Calm to Chaos: The San Bernardino Public Safety Response 
 

 

 

 

 

9.12 Consider provisions for victim and witness care while they are awaiting interviews and family 

members are being notified. These may include making cell phone charging stations and other forms of 

communication available and making food and water available. Counselors should be clearly identified 

with arm bands, vests, or similar so that they are readily identified by victims and witnesses. 

9.13 Jurisdictions and communities challenged by the need to interview large numbers of victims 

should consider staffing implications and request assistance from other agencies if appropriate. 

9.14 Jurisdictions and communities challenged by victim and witness accountability should consider 

methods for expediting the process to reduce stress on victims and witnesses. 

9.15 Post-event victim and responder welfare should be an integral part of interagency planning, 

training, and exercises. 

9.16 Ensure your department has a policy regarding mental health support after critical incidents, 

and clearly communicate it to the entire department. 

9.17 Assign a mental health or officer wellness incident commander to oversee officer mental 

health and coordinate services among participating agencies. 

9.18 Compel participation in critical incident debriefings or post-incident counseling both for 

victims and civilian and commissioned staff. 

9.19 Consider follow-up counseling as it is not unusual for post-traumatic stress to manifest itself 

several weeks or months after an event. 

9.20 In addition to mental health assistance, consider unit, team, or department-level debriefings 

to bring closure to the event. 

Appendix A. Lessons Learned 119 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

Appendix B. Analysis of San Bernardino 

City Unified School District After Action 

Report Data on the Impact of the 

December 2, 2015, Terrorist Attack 

Frank Straub, Maria Valdovinos, and Joyce Iwashita 

Context 

The San Bernardino City Unified School District (SBCUSD) responded to the December 2, 2015, terrorist 

incident scene with police officers as well as Office of Emergency Services personnel to assist with scene 

management and medical triage and security. In addition to providing first responders, the school district was significantly impacted in that it initiated a lockdown of all 80 schools and other buildings in an 

effort to secure all locations, personnel, and students in their care. This kept more than 50,000 students 

and 8,000 staff members and visitors from moving for a matter of hours. 

In the days and weeks that followed, the SBCUSD conducted approximately 90 detailed after action 

reviews (AAR) within each school and department. The SBCUSD was interested in having an independent 

group organize and analyze the AAR data and provide feedback on common themes and areas on which 

to focus. 

The Police Foundation (PF), under the direction of the U.S. Department of Justice, Office of Community 

Oriented Policing Services (COPS Office), agreed to undertake the analysis of SBCUSD AAR data as the 

data provide insight into some of the community impact within the larger critical incident review completed by the Police Foundation. 

Method 

The SBCUSD submitted 94 AARs to the PF. PF staff coded and analyzed the AARs for themes related to 

actions taken by the SBCUSD in the wake of the December 2, 2015, terrorist incident in San Bernardino, 

California. These AARs provide an overview of actions taken by 28 departments, 44 elementary schools, 

10 middle schools, and 10 high schools. In addition, one AAR was completed following a district meeting 

and one AAR was completed following a principals’ meeting. As each AAR was completed by a department or school, or following a group meeting, the site is considered to be the unit of analysis. 

121 
Methodological approach 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

To complete the AAR, each SBCUSD site was asked to record the following on paper: 

•	 What actually happened in the situation they just experienced 

•	 What they learned through this experience about what to do and how to do it 

•	 Given what was learned, how those insights can be applied to what is done next 

The review process, using an instrument provided by the SBCUSD, consisted of 

•	 identifying sites; 

•	 obtaining a description of the incidents; 

•	 asking the sites to identify lessons learned, including strengths and weaknesses of the response both 

at the site and district level. 

This type of critical incident technique is widely used to gather insight into both effective and ineffective 

behavior in a wide variety of contexts, and it is particularly useful for gathering insight into critical incidents (Hunt, Tourish, and Hargie 2000; Flanagan 1948; Flanagan 1954). The premise underlying a critical 

incident review of this type is that it can help illuminate feelings of dissatisfaction as well as satisfaction, 

and provide information that can be used to improve responses to future encounters (Hargie and Tourish, 2000). 

Within the descriptions in the AARs provided, sites recounted the events leading up to the incident. The 

description of the incident varied from an active shooter situation to a lockdown situation to a combination of both. 

Sites also recounted the people and other sites involved as well as communication problems they 

encountered and a number of other problems. Communication problems featured prominently in the 

AARs, and sites commented to a great extent on the strengths and weaknesses of communication within 

the site and within the district as whole as well as on issues of management and communication channels. 

Analytical approach 

The PF undertook a grounded theory approach, exploratory in nature, to review the SBCUSD AARs. The 

coding was content driven, and codes were derived from the data set itself (i.e., AAR narratives). This 

type of methodological and analytical approach is increasingly used by researchers to “develop complex, 

thematic analyses in order to combine interpretative sensitivity with systematic coding” (Hunt, Tourish, 

and Hargie 2000; Hoijer 1990; Kepplinger 1989; Liebes and Katz 1990; Livingstone and Lunt 1994). 

122 Bringing Calm to Chaos: The San Bernardino Public Safety Response 
 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

Furthermore, this type of approach allows for the identification of categories and subcategories that 

are grounded in the data and which can subsequently be used to code it. In response to the SBCUSD 

request, applied thematic analysis allows for the identification of common themes geared towards areas 

of improvement in this type of incident response. 

Following is an overview of the steps taken to prepare, code, and analyze the data contained in the 94 

after action reviews provided by the SBCUSD to the PF. 

Overview of steps* 

•	 Organized and prepared data for analysis 

•	 Reviewed all data to obtain a general sense of the information, and to reflect on its overall meaning 

(for example, identifying general issues that came up repeatedly and determining if the tone toward 

these issues was positive or negative) 

•	 Began coding process, which consisted of taking text data, segmenting it into categories, and labeling those categories with language used by the participant (e.g., “communication delay”) 

•	 Once grounded categories were identified, used these categories to code all of the text data 

•	 Generated themes based on categories; usually major recurring categories that can be supported 

with data even in spite of multiple perspectives 

•	 Depending on the extent of the analysis desired and whether description and theme identification 

were significant, may have done further in-depth analysis to connect themes 

•	 Answered the questions “what are the lessons learned?” and “how can these be applied in order to 

improve response in future incidents?” based on interpretations of themes and exploration and 

consideration of their meanings 

PF subject matter experts were involved in the process to tie existing lessons to those found in 

the review of the SBCUSD AARs. Highlights from this independent analysis are also woven into the 

main report. 

* The steps are adapted from process detailed in John W. Creswell, Research Design: Qualitative, Quantitative, and 

Mixed Methods Approaches (Thousand Oaks, CA: Sage Publications, Inc., 2003). 

Appendix B. Analysis of SBCUSD AAR Data 123 
 

 

 

 

 

 

 

 

 

 

 

 

 

Results 

Once the contents of the AARs as described by the sites were classified into major categories and all of 

the reviews were coded within these categories, the data were examined for the frequency with which 

various types of incidents and experiences were mentioned by the sites. 

Ninety-four AARs from 28 SBCUSD departments, 44 elementary schools, 10 middle schools, 10 high 

schools, and 2 debrief meetings (district and principal meetings) were obtained, coded, and analyzed 

(see table 1). 

Table 1. Site descriptions (n=94) 

Site Number of sites Percent (%) of sites* 

SBCUSD departments 28 30 

Elementary schools 44 47 

Middle schools 10 11 

High schools 10 11 

Debrief meetings 2 2 

*May add up to more than 100 because of rounding. 

The AARs were coded by considering six major categories that emerged through the initial review of 

content. Within each category grounded in the data there were a number of subcategories that worked 

to refine each of the main categories. These categories and subcategories were then used to code each 

individual AAR (see table 2). 

Table 2. Incident and event type: Identified categories and subcategories 

124 Bringing Calm to Chaos: The San Bernardino Public Safety Response 

Category	 Subcategory 

Nature of the incident	 Shooting 

Mass shooting 

Mass killing 

Terrorist attack 

Active shooting/shooter 

Emergency / Off-campus emergency 

Bomb threats 

Lockdown 

People management 

Communication failure 
Table 2 (cont’d) 

Category	 Subcategory 

Too many communication	 

sources / sources of information	 

District 

Text 

E-mail 

Social media 

News 

Parents 

Students 

Staff 

Community 

Communication issues	 Delayed communication / bad communication from the district 

Too many sources of communication 

Unofficial sources of communication 

No phone tree or other communication protocol 

Phones overwhelmed 

Miscommunication / unclear/lack of communication 

No clear chain of information 

More than e-mail needed for official communication 

Communication equipment failed (PA system) 

People involved	 Students 

Teachers 

Auxiliary staff 

Parents 

Media 

Police 

Difficulties involved	 Delay in notification of lockdown 

No lockdown protocol 

No active shooter protocol 

Unofficial sources of communication 

Delayed information 

Miscommunication 

Management of both on-site and off-site people 

Staff locked in and staff locked out 

Auxiliary staff not notified 

Not enough emergency supplies 

Difficulties ensuring basic needs of students during lockdown 

Lessons learned	 Don’t forget about auxiliary staff 

Physical security measures need improvement 

Protocols and drills needed for lockdown and other emergencies 

Establish protocol for parental notification 

Update information lists 

Appendix B. Analysis of SBCUSD AAR Data 125 
 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

Some variation in the description of the nature of the incident did exist. Some sites (approximately 54 

percent) identified the incident as the larger active shooter situation that led to the lockdown in the 

school district, while others (approximately 46 percent) identified and focused on the implementation of 

the lockdown as the main incident they were being asked to review. 

Communication issuesencountered 

Where the incident was identified as the lockdown and its implementation, the focus of the review was 

largely on communication difficulties encountered as well as failures in communication (see table 3). 

Table 3. Communications issues encountered and failures in communication reported (n=94) 

Issue Number of sites Percent (%) of sites 

Delayed communication / bad 

communication from district 

38 40 

Too many sources of communication / 

unofficial sources / miscommunication 

(unclear or lack) 

64 68 

No communication protocol / 

Communication protocol needed 

33 35 

Communication equipment failed 

(e.g., PA system) 

16 17 

Concern was expressed over delayed communication or bad communication from the district in 38 sites 

(40 percent); too many sources of communication or unofficial sources of communication or miscommunication in 64 sites (68 percent); need for a communication protocol in 33 sites (35 percent); and failures in communication due to equipment issues in 16 sites (17 percent). For example, across the sites 

that reported issues with communication equipment, the main issue was that notifications delivered via 

the PA were inaudible to teachers and students who were locked in their classrooms because of the 

lockdown order. 

“Locked doors even though announcements could not be heard . . . we 

had to open the door to hear announcements.” 

— Arrowview Middle School 

In a number of the AARs, the sites were motivated to provide suggestions for a communication protocol. 

Among the suggestions made, 13 sites (14 percent) thought that an alert such as a bell or code word 

would be a good idea because the teachers could respond without alarming students; however, there 

were also some concerns that non-staff persons in the buildings would not be familiar with a code word. 

126 Bringing Calm to Chaos: The San Bernardino Public Safety Response 
 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

Fifteen sites (16 percent) also suggested having a clear chain of official information as part of a communication protocol, and 8 sites (9 percent) noted that having a template with the necessary details appropriate for dissemination would be very helpful. 

The lockdown notification distributed via e-mail appeared to be problematic for two reasons. For one, 

the timing of the notification coincided with lunch periods or recess periods for various sites, so a number of people were away from their computers and were not immediately aware of the lockdown. In 

addition, it seems that a number auxiliary staff members may not have had access to district e-mails or 

computers, so those staff members were also unaware. 

“Substitute teacher could not get e-mail updates from district or school 

(only when called).” 

— Bob Holcomb Elementary 

Because of the timing of the lockdown notification and the difficulties experienced with e-mail notification of the lockdown, 24 sites (26 percent) suggested the district employ more than one form of notification for lockdowns and other emergency notifications. 

Good communication 

Seven sites reported good communication experiences: (1) Charter School Operations, (2) College and 

Career Readiness and Linked Learning, (3) Barton Elementary, (4) Bradley Elementary, (5) Monterey 

Elementary, (6) Richardson Prep Hi Middle School, and (7) Sierra High School. While many of these sites 

also mention room for improvement, they all note appreciation for the level of communication they did 

have whether at the site or district level or with the school police. 

“All of the communication by district and our own office was extremely 

helpful.” 

—Bradley Elementary School 

Difficulties encountered 

The main difficulties encountered by the sites were associated with the lockdown process, managing 

people both on site and off site, and the lack of contingency supplies and plans for ensuring the basic 

needs of students during the lockdown. 

Appendix B. Analysis of SBCUSD AAR Data 127 
 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

Issues associated with lockdown process 

The lockdown process proved to be problematic for sites for a number of reasons (see table 4). In particular, six sites (6 percent) reported having no lockdown protocol or characterized the protocol and 

procedure as being inconsistent or unclear. There was widely reported confusion across the sites over 

the difference between a lockdown order and a lockout order. This may have been an inadvertent use of 

two words to refer to the same process, but more than one-third of the sites (35 percent) found this to 

be problematic primarily because of the confusion it caused. At the same time, 14 sites (15 percent) 

called an internal lockdown or inclement weather lockdown prior to official lockdown notification from 

the district for various reasons.

* 

“12:50 [principal] made intercom announcement ‘lockout’ doors and 

gates must be locked. Staff didn’t know what ‘lockout’ meant. 1:10 

[principal] made announcement ‘lockdown.’” 

—Lankershim Elementary School 

Table 4. Issues encountered in lockdown process (n=94) 

Issue Number of sites Percent (%) of sites 

No protocol 6 6 

Inconsistent/Unclear protocol/procedure 31 33 

Lockdown versus lockout unclear 33 35 

Protocol/Practice/Drills Needed 51 54 

Because of the numerous issues encountered in the lockdown process, more than half of the sites 

(54 percent) reported that in addition to a clear lockdown protocol, practice and drills are also needed. 

Similarly, as with the communication issues encountered, sites were motivated to provide suggestions 

for a lockdown protocol. Among the suggestions made, 8 sites (9 percent) thought that signs and posters depicting the lockdown procedure would be helpful and 13 (14 percent ) thought that severity levels indicating the need anywhere from a partial to full lockdown would be appropriate. In addition, ten 

sites (11 percent) thought that notification of a lockdown should be made as soon as possible, four sites 

* Specifically, Anton Elementary School, Arrowhead Elementary School, Bradley Elementary School, Norton 

Elementary School, Riley College Prep Academy, Urbita Elementary School, and Warm Springs Elementary School 

called some form of inclement weather emergency. Del Rosa Elementary School, H. Frank Dominguez Elementary 

School, Kimbark Elementary School, Mt. Vernon Elementary School, Norton Elementary School, Parkside 

Elementary School, and Middle College High School all called some form of internal lockdown prior to the district 

notification. 

128 Bringing Calm to Chaos: The San Bernardino Public Safety Response 
Appendix B. Analysis of SBCUSD AAR Data 129 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

(4 percent) recommended there be a clear chain of notification, and 4 sites (4 percent) also recommended having a contingency for staff persons off site who would effectively be locked out in a lockdown situation. 

Management issues encountered 

There were a number of management issues encountered across all 94 sites (see table 5). Nineteen sites 

(21 percent) reported difficulties with the management of students during the lockdown as well as after 

the lockdown order was lifted both on site and off site. Thirty-four sites (36 percent) reported numerous 

difficulties with the management of parents during the lockdown. For example, among the most widely 

reported issues that arose associated with parents were parents arriving to pick up children during the 

lockdown, aggressive parents, and parents calling into the school asking to speak to their children. 

“Some parents were knocking at certain classroom doors asking for the 

teacher to open the door and let them take their child.” 

—Riley College Prep Academy 

“Parents that came and were upset at staff for not opening the doors 

[are] a potential safety hazard. Allowing people in and out during a 

lockdown causes chaos.” 

—Anderson School 

Table 5. Management difficulties encountered (n=94) 

Management difficulty 

Students 

Auxiliary staff (custodial / substitutes / 

bus drivers / crossing guards, etc.) 

Parents 

Teachers 

Physical site 

On site 

Off site 

Phones 

Information sources 

Number of sites 

19 

20 

34 

7 

6 

27 

15 

18 

7 

Percent (%) of sites 

21 

21 

36 

7 

6 

29 

16 

19 

7 
 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

The management of off-site staff and auxiliary staff was also an unanticipated issue encountered during 

the lockdown. For example, auxiliary staff and off-site staff returning to the school from field trips or 

from busing children were locked out because of the lockdown and did not have the necessary information on the situation, nor did they have contingency plans in place for where to go until the lockdown 

order was lifted. In some sites, the layout of the buildings (for example, in buildings with connected 

rooms) made a full lockdown impossible. 

“[W]e had field trip buses and HTS [home to school] buses delivering 

students, and sites did not accept them. We had several buses with 

students sitting out in front of the school instead of being allowed to 

enter a secured site.” 

—Transportation Department 

The management of information sources and phones also proved to be a prominent issue. For example, 

18 sites (19 percent) reported that phones were overwhelmed by calls from parents and the media. In at 

least one instance, the inability to dial outside of the area code using district phones proved problematic. As already mentioned in the section on communication issues, the large number of information 

sources (mostly informal or unofficial sources) proved to be a management issue for staff at the various 

departments and schools within the district. 

Unique site differences in supplies and services needed 

The lack of contingency plans for supplies and ensuring the basic needs of students in the event of a 

lockdown was a prominent issue across sites, but there were some unique site differences (see table 6). 

Table 6. Site differences in supplies and services needed 

Site type Number of sites Sites with differences: n (%) 

SBCUSD departments 28 6 (21) 

Elementary schools 44 36 (82) 

Middle schools 10 3 (30) 

High schools 10 9 (90) 

Total 92* 54 (59) 

* The two AARs from the debrief meetings are not included in this table. 

130 Bringing Calm to Chaos: The San Bernardino Public Safety Response 
 

 

 

 

 

 

 

 

 

 

 

Among the supplies and access to services mentioned as lacking or restricted due to the lockdown were 

food, water, and toileting and personal needs (see table 7). Sites reported concerns over being able to 

fulfill first aid needs and obtaining access to medicines stored in the nurse’s station in the event of a prolonged lockdown. As a result of the lockdown, sites also reported realizing that they had no inventory or 

an unknown inventory of basic supplies. 

Table 7. Types of supplies and services needed (n=94) 

Supplies and services Number of sites Percent (%) of sites 

Food 25 27 

Water 15 16 

Toileting / Personal needs 38 40 

First aid 23 24 

Medicine 8 9 

No inventory / Inventory unknown 1 1 

Other (flashlights / batteries / keys etc.) 14 15 

The most prominent site difference was in reference to toileting and personal needs for students in 

elementary schools. This was a widely reported difficulty encountered by teachers who had to make 

makeshift toilets for students out of trash cans in their classrooms. This posed a number of privacy concerns for both students and teachers. This seemed to be less of a problem for older student populations, 

but it was a problem nonetheless. 

Appendix B. Analysis of SBCUSD AAR Data 131 
Lessons learned 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

There were a number of lessons learned and identified across sites, but among the most prominent 

ones were not forgetting about auxiliary staff, improving physical security measures in the buildings, 

establishing a system for parental notification of a lockdown and updates, and ensuring that lists were 

updated and accessible to all staff, including auxiliary staff (see table 8). 

Table 8. Lessons learned (n=94) 

Lesson learned Number of sites % of sites 

Don’t forget about auxiliary staff 19 20 

Physical security measures need improvement 37 39 

Lockdown and other protocols/drills needed 27 29 

System for parental notification should be in place 25 27 

Update lists (contact information / rosters / 12 13 

attendance / etc.) 

For example, it was reported that at times teachers did not have access to contact information, roster information, and attendance information for their classes, which made it difficult to manage not 

only the students but also the parental notification process because of outdated or incomplete contact information. 

“We need to update our emergency list of parent phone numbers more 

frequently.” 

— Dr. Mildred Dalton Henry Elementary 

A main lesson learned and key theme throughout the AARs was the need to have protocols in place for 

district staff. In addition to the lockdown protocol detailed earlier in this report, other protocols identified as necessary were an active shooter protocol, according to staff at 18 sites (19 percent); a communication protocol or plan, according to staff at 23 sites (24 percent); and a general emergency protocol, 

according to staff at 10 sites (11 percent). 

Positive police response 

While police response was not a recurring item addressed throughout the after action reviews, when 

it was addressed the assessment was generally positive. In particular, six sites commended the police 

response. These sites were (1) Accounting Services, (2) Employee Benefits and Workers’ Compensation, 

(3) Family Resource Center, (4) Fiscal Services, (5) Anderson School, and (6) Serrano Middle School. 

132 Bringing Calm to Chaos: The San Bernardino Public Safety Response 
 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

Interpretation/discussion/recommendations 

Threat assessment 

•	 Is the threat internal to the school district or to a specific school or schools? For example, is it a general bomb threat or an active shooter threat? Specific protocols should be established to respond to 

internal threats. 

•	 Is the threat external to the school district or to a specific school or schools? For example, there may 

be criminal activity or police action in the vicinity of a school or schools that potentially threatens 

the safety of students, staff, and facility or a natural event such as a fire or flooding. Specific protocols should be developed to respond to external threats. 

•	 The initial analysis of the threat will dictate what protocol(s) should be implemented at the district, 

school, or facility level. Consideration should be given to developing a simple and concise process to 

evaluate potential threat levels and communicate them within the district, schools, and facilities. 

•	 The threat should be continuously monitored to determine the proper response over time and to 

reassess the threat level assigned. This would suggest that the school district employ one or more 

analysts to monitor threats to the safety and security of the school district on a regular basis. The 

analyst should produce threat assessments and communicate them in a manner consistent with 

protocols. It would seem the analyst should be located within the Police or Emergency Management 

function. 

•	 Careful consideration based on the threat level should be given to restricting movement inside 

schools and facilities. The more restricted movement becomes, the more difficult it will be to gain 

compliance initially and over time as students and staff are unable to access supplies, medication, 

and toilets. Freeing up internal movement as soon as it is safe to do so should be the focus of the 

ongoing threat analysis. 

Policy and protocol 

•	 Protocols should be established at the local (school- and facility-specific) as well as the district level 

to identify alternate locations for transporting students and staff in the event that they are locked 

out of their school or facility. This should be a critical aspect of the preplanning process. 

•	 The district should develop and implement active shooter protocols and drills. Consideration should 

be given to engaging parents, parent organizations, or representatives in the drills and protocol development. If it is done properly, parental involvement will increase transparency, build trust, identify communication strategies, and improve interactions and collaboration during an event. 

Appendix B. Analysis of SBCUSD AAR Data 133 
 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

Communications 

•	 Consideration should be given to the robust use of social media for information gathering, information dissemination, and public relations. The San Bernardino County Sheriff’s Department has a 

full-time employee charged with monitoring social media and disseminating information. That individual played a critical role during the terrorist attack as well as doing so on a routine basis. Because 

communication was identified as a critical issue, the district should explore creating a similar position within the public information and affairs office, the office of emergency management, or the 

police department. 

•	 Social media provides an invaluable opportunity to communicate with staff, parents, and others. 

Information can be pushed out rapidly and continuously updated. In addition, it can provide an opportunity to identify emerging issues and challenges and to answer questions in real time. 

•	 Other options for communication could include a 1-800 phone number, a proactive automated calling system (for which it would be essential to have a complete and regularly updated contact list), or 

a version of a storm warning or Amber alert system. 

Conclusion 

The school district is fortunate to have an outstanding police department and office of emergency management, both of which provided significant support during the terrorist attack. The school district 

should continue to build on the success and expertise of the police and the office of emergency management. 

In conclusion, the efforts being made in the school district and the level of importance that being placed 

on these important issues are encouraging. The fourth CompStat principle is relentless assessment and 

follow up, which suggests that this is a continuous process that requires a dedicated and knowledgeable 

staff with situational awareness, preplans and protocols, threat assessment capabilities, social media 

expertise, and the commitment to monitor and adjust policies, practices, and procedures on a regular 

and continuing basis. 

134 Bringing Calm to Chaos: The San Bernardino Public Safety Response 
 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

References 

Flanagan, John C. 1948. “Contributions of Research in the Armed Forces to Personnel Psychology.” 

Personnel Psychology 1(1): 53–62. doi: 10.1111/j.1744-6570.1948.tb01293.x. 

Flanagan, John C. 1954. “The critical incident technique.” Psychological Bulletin 51(4): 327–360. 

https://www.apa.org/pubs/databases/psycinfo/cit-article.pdf. 

Hargie, Owen D.W., and Dennis Tourish. 2000. Handbook of Communication Audits for Organisations. 

New York: Routledge. 

Höijer, Birgitta. 1990. “Studying Viewers’ Reception of Television Programmes: Theoretical and 

Methodological Considerations.” European Journal of Communication 5(1): 29–56. doi: 

10.1177/0267323190005001003. 

Hunt, Oriagh, Dennis Tourish, and Owen D.W. Hargie. 2000. “The Communication Experiences of 

Education Managers: Identifying Strengths, Weaknesses, and Critical Incidents.” International 

Journal of Educational Management 14(3): 120–129. http://uir.ulster.ac.uk/8954/1/IJEM.pdf. 

Kepplinger, Hans Mathias. 1989. “Content Analysis and Reception Analysis.” American Behavioral 

Scientist, 33(2): 175–182. doi: 10.1177/000276428903300208. 

Liebes, Tamar, and Elihu Katz. 1990. The Export of Meaning: Cross-Cultural Readings of Dallas. Oxford: 

Oxford University Press. 

Livingstone, Sonia, and Peter Lunt. 1994. Talk on Television: Audience Participation and Public Debate. 

New York: Routledge. 

Appendix B. Analysis of SBCUSD AAR Data 135 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

About the Authors
 

San Bernardino Critical Response project team (subject matter experts) 

Sheriff Rod Hoops (Ret.) provided law enforcement and public administrator subject matter expertise 

to the project. A 34-year veteran of the San Bernardino County Sheriff’s Department (SBCSD) in southern California, Hoops served as Sheriff-Coroner-Public Administrator from 2009 until his retirement in 

December 2012. As sheriff, Hoops increased the diversity and educational achievement levels of command staff and instituted a shared-leadership strategy to empower decision making by commanders at 

the local level. Over the course of his 34-year career, Hoops served as the assistant sheriff overseeing 

SBCSD operations and as deputy chief and chief of police in numerous cities served by the department. 

From 2008 to 2009, he was chairman of the Los Angeles High Intensity Drug Trafficking Area (LA-HIDTA). 

Hoops holds a bachelor’s degree in criminal justice and a master’s degree in public administration from 

California State University–Fullerton and is a graduate of the California Command College. 

Chief Rick Braziel (Ret.) provided law enforcement expertise as well as Critical Response and Collaborative Reform experience to the project. He has been an executive fellow of the Police Foundation for 

three years and has been the team leader on two of the Police Foundation’s critical incident reviews. 

Braziel served as chief of the Sacramento Police Department (SPD) from 2008 until his retirement in 

December 2012. A 33-year veteran of the SPD, including 18 years as a member of the executive leadership team, he held a variety of ranks. As deputy chief, his assignments included the Office of Operations, 

Office of Investigations, Office of Technical Services, and Office of Homeland Security and Emergency 

Services. Braziel also served as president of the California Peace Officers Association, and treasurer of 

the Police Executive Research Forum and as a member of the California Police Chiefs Association Board 

of Directors and the Salvation Army advisory board. He also served as chair of the Central California 

Intelligence Center Governance Board. He was recently appointed by Governor Jerry Brown to the California Commission on Peace Officer Standards and Training (POST). Braziel is currently Inspector General 

for Sacramento County. 

Braziel received his BA and MA in Communication Studies from California State University–Sacramento. 

In 2006, he received a masters of arts in Security Studies from the U.S. Naval Postgraduate School. His 

thesis resulted in a $3.1 million grant toward the creation of communities of learning. In addition to 

numerous commendations, Braziel received the City of Sacramento Silver Medal of Valor in 1988, Distinguished Service Award in 2001, and a Unit Citation in 2002. He was named 1995 Alumnus of the Year 

by California State University–Sacramento. Braziel coauthored Cop Talk: Essential Communication Skills 

for Community Policing.

* 

* Virginia Kidd and Rick Braziel, COP Talk: Essential Communication Skills for Community Policing (San Francisco: 

Acada Books, 1999). 

137 
 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

Chief Frank Straub (Ret.), PhD, provided on-site project management, coordinating the work of subject 

matter experts and providing law enforcement guidance and expertise to the project. He managed the 

document review process and worked closely with Jennifer Zeunik to ensure that all on- and off-site 

decisions and activities met project goals. A 30-year veteran of law enforcement, Dr. Straub currently 

serves as the Director of Strategic Studies for the Police Foundation. He last served as the chief of the 

Spokane (Washington) Police Department, where he received national recognition for the major reforms 

and community policing programs he implemented and significant crime reductions achieved during 

his tenure. Dr. Straub also served as director of public safety for the City of Indianapolis, Indiana, during 

which time the Indianapolis Metropolitan Police Department reduced homicides to the lowest level in 

20 years. Dr. Straub has also served as the public safety commissioner for the City of White Plains, 

New York, where his department reduced serious crime by 40 percent. He established the first policecommunity mental health response team in Westchester County to proactively assist persons challenged by mental illness, homelessness, and domestic violence. Dr. Straub previously served as the 

deputy commissioner of training for the New York City Police Department and as a federal agent. He 

holds a BA in Psychology from St. John’s University, and MA in Forensic Psychology from John Jay College of Criminal Justice, and a PhD in Criminal Justice from the City University of New York’s Graduate 

Center. He co-authored a book on performance-based police management and has published several 

articles regarding community policing, police reform, and jail management. 

George Watson provided media, community relations, and writing expertise to the project. He spent 

more than two decades building a career as an acclaimed journalist and public official. These two professions give him a unique expertise in media and community relations, handling a crisis while also specializing in helping people build their public identities and manage their reputations. Watson worked for 

18 years in daily journalism, writing and editing for some of the largest and smallest newspapers and 

websites across the United States. He anchored the Associated Press’s metro desk in New York City, 

wrote for The New York Times, and won a handful of national awards for investigative work in southern 

California. He has covered mass shootings, officer-involved incidents, and serial killers; reported from 

Afghanistan; and also spent time at Ground Zero in the days after the terrorist attacks of September 11, 

2001. He has used blogs and other social media to cover both breaking news and larger in-depth pieces 

while also anchoring a newspaper’s live web coverage of local and national elections. 

In 2009, Watson became chief of staff for a member of the San Bernardino County Board of Supervisors. 

For four years, Watson led the office for a county that is home to 2.4 million people while directing all 

media and public interaction. The supervisor was commended for the office’s use of social media to 

connect directly with the public, providing easy-to-understand information to constituents and also 

showing a level of public service and interaction rarely seen from a politician. Watson is a graduate of 

Hobart College. 

138 Bringing Calm to Chaos: The San Bernardino Public Safety Response 
 

 

 

 

 

 

 

 

 

 

 

 

 

Police Foundation project staff* 

Jim Bueermann, President, is local to San Bernardino and provided executive oversight of the project. 

Blake Norton, VP/COO, provided high-level strategy and coordination and served as the primary liaison 

to the COPS Office throughout the project. 

Jennifer Zeunik, Director of Programs, provided overall project structure and oversight. She worked 

with project staff in driving toward goals and deliverables and coordinated activity of on- and off-site 

staff and SMEs. Zeunik also served as a writer and quality control manager on the final report. 

Rebecca Benson, Senior Policy Analyst, provided project support; document writing, review, and editing; and technical and mapping support. 

Ben Gorban, Policy Analyst, provided project support as well as document writing, review, and editing. 

Joyce Iwashita, Project Assistant, provided project support; document writing, review, and editing; and 

technical and mapping support. 

* Project staff bios can be found at http://www.policefoundation.org. 

About the Authors 139 
 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

About the Police Foundation
 

The Police Foundation is a national nonmember, nonpartisan, nonprofit organization that has been 

providing technical assistance and conducting innovative research on policing for nearly 45 years. 

The professional staff at the Police Foundation works closely with law enforcement, community members, judges, prosecutors, defense attorneys, and victim advocates to develop research, comprehensive 

reports, policy briefs, model policies, and innovative programs. The organization’s ability to connect client departments with subject matter expertise, supported by sound data analysis practices, makes us 

uniquely positioned to provide critical response and technical assistance (CRTA). 

The Police Foundation has been on the forefront of researching and providing guidance on community 

policing practices since 1985. Acceptance of constructive change by police and the community is central 

to the purpose of the Police Foundation. From its inception, the Police Foundation has understood that 

in order to flourish, police innovation requires an atmosphere of trust; a willingness to experiment and 

exchange ideas both within and outside the police structure; and, perhaps most importantly, a recognition of the common stake of the entire community in better police services. 

The Police Foundation prides itself in a number of core competencies that provide the foundation for 

CRTA, including a history of conducting rigorous research and strong data analysis, an Executive Fellows 

program that provides access to some of the strongest thought leaders and experienced law enforcement professionals in the field, and leadership with a history of exemplary technical assistance program 

management. 

140 
 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

About the COPS Office
 

The Office of Community Oriented Policing Services (COPS Office) is the component of the U.S. 

Department of Justice responsible for advancing the practice of community policing by the nation’s 

state, local, territorial, and tribal law enforcement agencies through information and grant resources. 

Community policing begins with a commitment to building trust and mutual respect between police 

and communities. It supports public safety by encouraging all stakeholders to work together to address 

our nation’s crime challenges. When police and communities collaborate, they more effectively address 

underlying issues, change negative behavioral patterns, and allocate resources. 

Rather than simply responding to crime, community policing focuses on preventing it through strategic 

problem solving approaches based on collaboration. The COPS Office awards grants to hire community 

police and support the development and testing of innovative policing strategies. COPS Office funding 

also provides training and technical assistance to community members and local government leaders, as 

well as all levels of law enforcement. 

Another source of COPS Office assistance is the Collaborative Reform Initiative for Technical Assistance 

(CRI-TA). Developed to advance community policing and ensure constitutional practices, CRI-TA is an 

independent, objective process for organizational transformation. It provides recommendations based 

on expert analysis of policies, practices, training, tactics, and accountability methods related to issues of 

concern. 

Since 1994, the COPS Office has invested more than $14 billion to add community policing officers to the 

nation’s streets, enhance crime fighting technology, support crime prevention initiatives, and provide 

training and technical assistance to help advance community policing. 

•	 To date, the COPS Office has funded the hiring of approximately 127,000 additional officers by more 

than 13,000 of the nation’s 18,000 law enforcement agencies in both small and large jurisdictions. 

•	 Nearly 700,000 law enforcement personnel, community members, and government leaders have 

been trained through COPS Office-funded training organizations. 

•	 To date, the COPS Office has distributed more than eight million topic-specific publications, training 

curricula, white papers, and resource CDs. 

•	 The COPS Office also sponsors conferences, roundtables, and other forums focused on issues critical 

to law enforcement. 

The COPS Office information resources, covering a wide range of community policing topics—from 

school and campus safety to gang violence—can be downloaded at www.cops.usdoj.gov. This website is 

also the grant application portal, providing access to online application forms. 

141 
In December 2015, two terrorists attacked a training session and holiday party for San Bernardino County employees, killing 14 and 

wounding 24 including two police officers. But further losses were averted by the response of the police department, sheriff’s office, 

emergency services, and FBI, who came together to prevent additional deaths and injuries. 

With a grant from the Office of Community Oriented Policing Services (COPS Office), the Police Foundation critically, objectively, and 

thoroughly examined all aspects of the public safety response—including preparation and aftermath—and prepared this critical 

incident review of the events surrounding the shooting. 

This review provides a detailed overview of the incident response; lessons learned to improve responding agencies’ policies, 

procedures, tactics, systems, culture, and relationships; and guidance to other agencies and first responders as they prepare for 

responses to terrorist, active shooter or other hostile events, and mass casualty incidents. 

U.S. Department of Justice 

Office of Community Oriented Policing Services 

145 N Street NE 

Washington, DC 20530 

To obtain details about COPS Office programs, call the 

COPS Office Response Center at 800-421-6770. 

Visit the COPS Office online 

at www.cops.usdoj.gov. 

Police Foundation 

1201 Connecticut Avenue NW, Suite 200 

Washington, DC 20036 

To obtain details about Police Foundation programs, 

call 202-833-1460 

Visit the Police Foundation online 

at www.policefoundation.org.

e061621766 

Published 2016